xmrig | d1178241d20d0d1fc7035e37b701a20d236aa2792cd9a36959908f6de8ea4fbf

Analysis

max time kernel
63s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Size 1.9MB
Sample240427-2cmryaac2s
SHA256 d1178241d20d0d1fc7035e37b701a20d236aa2792cd9a36959908f6de8ea4fbf
MD5 03c318f87a0d38fa5e29f5a91dac807f
SHA1 521655606ec73b87cb0a4ce9b2636c0d1d72f931
SHA512 ce14c11d82233bff7c9398ba2046cb209fdfcfd3597ec12b7b534a7ea272a7ae1012cff363be9c1726c63d7f3ae848b2cced4777f88da51f1f9c60c4d3096855
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uf:NAB8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/3128-470-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	xmrig
behavioral2/memory/3896-471-0x00007FF663320000-0x00007FF663712000-memory.dmp	xmrig
behavioral2/memory/3560-472-0x00007FF701C30000-0x00007FF702022000-memory.dmp	xmrig
behavioral2/memory/3068-473-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp	xmrig
behavioral2/memory/1676-469-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	xmrig
behavioral2/memory/3664-67-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp	xmrig
behavioral2/memory/1404-54-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	xmrig
behavioral2/memory/1268-474-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp	xmrig
behavioral2/memory/4300-477-0x00007FF761C70000-0x00007FF762062000-memory.dmp	xmrig
behavioral2/memory/4516-478-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp	xmrig
behavioral2/memory/3328-476-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	xmrig
behavioral2/memory/368-475-0x00007FF646390000-0x00007FF646782000-memory.dmp	xmrig
behavioral2/memory/2268-506-0x00007FF708090000-0x00007FF708482000-memory.dmp	xmrig
behavioral2/memory/1576-495-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp	xmrig
behavioral2/memory/3424-488-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp	xmrig
behavioral2/memory/1220-524-0x00007FF762320000-0x00007FF762712000-memory.dmp	xmrig
behavioral2/memory/3512-529-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	xmrig
behavioral2/memory/4048-533-0x00007FF773A30000-0x00007FF773E22000-memory.dmp	xmrig
behavioral2/memory/2972-539-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp	xmrig
behavioral2/memory/3564-521-0x00007FF723D50000-0x00007FF724142000-memory.dmp	xmrig
behavioral2/memory/4964-2419-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	xmrig
behavioral2/memory/1404-2428-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	xmrig
behavioral2/memory/4964-2430-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	xmrig
behavioral2/memory/3512-2432-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	xmrig
behavioral2/memory/1676-2434-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	xmrig
behavioral2/memory/3896-2443-0x00007FF663320000-0x00007FF663712000-memory.dmp	xmrig
behavioral2/memory/3128-2446-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	xmrig
behavioral2/memory/368-2452-0x00007FF646390000-0x00007FF646782000-memory.dmp	xmrig
behavioral2/memory/3328-2454-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	xmrig
behavioral2/memory/2972-2450-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp	xmrig
behavioral2/memory/1268-2448-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp	xmrig
behavioral2/memory/3560-2444-0x00007FF701C30000-0x00007FF702022000-memory.dmp	xmrig
behavioral2/memory/3068-2439-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp	xmrig
behavioral2/memory/3664-2436-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp	xmrig
behavioral2/memory/4048-2441-0x00007FF773A30000-0x00007FF773E22000-memory.dmp	xmrig
behavioral2/memory/2268-2465-0x00007FF708090000-0x00007FF708482000-memory.dmp	xmrig
behavioral2/memory/4300-2470-0x00007FF761C70000-0x00007FF762062000-memory.dmp	xmrig
behavioral2/memory/3424-2473-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp	xmrig
behavioral2/memory/4516-2469-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp	xmrig
behavioral2/memory/3564-2462-0x00007FF723D50000-0x00007FF724142000-memory.dmp	xmrig
behavioral2/memory/1576-2472-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp	xmrig
behavioral2/memory/1220-2460-0x00007FF762320000-0x00007FF762712000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4964	PHzWtGZ.exe
1404	WdmYsCJ.exe
3512	VdTLFnl.exe
3664	ixKnPdR.exe
1676	xSubBrr.exe
3128	Tiexlvh.exe
3896	iyrGRee.exe
3560	iLtWcAs.exe
4048	KKoAfPw.exe
3068	sFnbeRF.exe
2972	lSReJmJ.exe
1268	nliYJCC.exe
368	BLjkpgj.exe
3328	anMJFkE.exe
4300	BKTSbxC.exe
4516	VCFKiPH.exe
3424	WuwiegC.exe
1576	FRLvPWF.exe
2268	jEJXgNg.exe
3564	ielurPd.exe
1220	YyNOLXU.exe
3832	ajazpdD.exe
3076	QvBHgcJ.exe
4848	HlAZIBO.exe
4372	UtGyPQj.exe
1884	aXVduOR.exe
1868	DdIBLuI.exe
4864	nmbPpuW.exe
2412	onevXfS.exe
2540	wsGDcbN.exe
2264	fulODJi.exe
2696	XnhbrWW.exe
4992	nLQXojG.exe
2820	xVPqpjl.exe
3432	siKWGMH.exe
1444	BMOtGzB.exe
1752	amLkRIl.exe
1228	qNHlgDC.exe
2064	EwQZJCd.exe
3984	kIaniBl.exe
2720	ZPuhGCQ.exe
4524	fHPoHlx.exe
3672	dYvtyox.exe
3544	MsuVtiR.exe
1096	dSjnMLc.exe
1876	KjTCKRp.exe
4828	dHfoSpC.exe
4744	qUmLncM.exe
392	QGVwqTb.exe
4712	ViMegpl.exe
3420	CMKljQa.exe
1104	iCdQGRB.exe
4176	PIrhwHX.exe
2960	kOlSIbr.exe
4160	buQBjKa.exe
4064	RzoExBT.exe
3508	uUgcsDr.exe
2304	HBSGzgg.exe
4840	ImXIHiN.exe
3484	rfCkhuM.exe
3500	FARscMv.exe
820	pALXsXp.exe
3376	WXgzLGe.exe
4580	KmPSIsY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/564-0-0x00007FF600B70000-0x00007FF600F62000-memory.dmp	upx
behavioral2/files/0x0007000000022a9c-5.dat	upx
behavioral2/files/0x000a000000023bcb-7.dat	upx
behavioral2/files/0x000a000000023bcc-18.dat	upx
behavioral2/memory/4964-14-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	upx
behavioral2/files/0x000b000000023bca-8.dat	upx
behavioral2/files/0x000a000000023bcd-22.dat	upx
behavioral2/files/0x000a000000023bd1-56.dat	upx
behavioral2/files/0x000b000000023bd0-55.dat	upx
behavioral2/files/0x000a000000023bd2-61.dat	upx
behavioral2/files/0x000a000000023bd5-80.dat	upx
behavioral2/files/0x000a000000023bd7-94.dat	upx
behavioral2/files/0x000a000000023bd9-104.dat	upx
behavioral2/files/0x000a000000023bdb-114.dat	upx
behavioral2/files/0x000e000000023bf1-153.dat	upx
behavioral2/files/0x0008000000023bfa-166.dat	upx
behavioral2/files/0x000e000000023c05-178.dat	upx
behavioral2/memory/3128-470-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	upx
behavioral2/memory/3896-471-0x00007FF663320000-0x00007FF663712000-memory.dmp	upx
behavioral2/memory/3560-472-0x00007FF701C30000-0x00007FF702022000-memory.dmp	upx
behavioral2/memory/3068-473-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp	upx
behavioral2/memory/1676-469-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	upx
behavioral2/files/0x0009000000023c00-176.dat	upx
behavioral2/files/0x0009000000023c01-173.dat	upx
behavioral2/files/0x0009000000023bff-171.dat	upx
behavioral2/files/0x000a000000023bea-156.dat	upx
behavioral2/files/0x000b000000023be2-151.dat	upx
behavioral2/files/0x000b000000023be1-146.dat	upx
behavioral2/files/0x000b000000023be0-141.dat	upx
behavioral2/files/0x000a000000023bdf-136.dat	upx
behavioral2/files/0x000a000000023bde-131.dat	upx
behavioral2/files/0x000a000000023bdd-124.dat	upx
behavioral2/files/0x000a000000023bdc-119.dat	upx
behavioral2/files/0x000a000000023bda-108.dat	upx
behavioral2/files/0x000a000000023bd8-99.dat	upx
behavioral2/files/0x000a000000023bd6-88.dat	upx
behavioral2/files/0x000a000000023bd4-78.dat	upx
behavioral2/files/0x000b000000023bcf-74.dat	upx
behavioral2/memory/3664-67-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-63.dat	upx
behavioral2/files/0x000a000000023bce-57.dat	upx
behavioral2/memory/1404-54-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	upx
behavioral2/memory/1268-474-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp	upx
behavioral2/memory/4300-477-0x00007FF761C70000-0x00007FF762062000-memory.dmp	upx
behavioral2/memory/4516-478-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp	upx
behavioral2/memory/3328-476-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	upx
behavioral2/memory/368-475-0x00007FF646390000-0x00007FF646782000-memory.dmp	upx
behavioral2/memory/2268-506-0x00007FF708090000-0x00007FF708482000-memory.dmp	upx
behavioral2/memory/1576-495-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp	upx
behavioral2/memory/3424-488-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp	upx
behavioral2/memory/1220-524-0x00007FF762320000-0x00007FF762712000-memory.dmp	upx
behavioral2/memory/3512-529-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	upx
behavioral2/memory/4048-533-0x00007FF773A30000-0x00007FF773E22000-memory.dmp	upx
behavioral2/memory/2972-539-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp	upx
behavioral2/memory/3564-521-0x00007FF723D50000-0x00007FF724142000-memory.dmp	upx
behavioral2/memory/4964-2419-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	upx
behavioral2/memory/1404-2428-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	upx
behavioral2/memory/4964-2430-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	upx
behavioral2/memory/3512-2432-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	upx
behavioral2/memory/1676-2434-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	upx
behavioral2/memory/3896-2443-0x00007FF663320000-0x00007FF663712000-memory.dmp	upx
behavioral2/memory/3128-2446-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	upx
behavioral2/memory/368-2452-0x00007FF646390000-0x00007FF646782000-memory.dmp	upx
behavioral2/memory/3328-2454-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rfCkhuM.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fUxThBN.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ldKXewF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ueuPeOa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\rgFBvhz.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\UeUrekG.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GDvSoHL.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\Ambspqm.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\TrmHglg.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\zFMupHi.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\MKbwkpC.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\gbPlddP.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\JqlNafP.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\mqHsotK.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fikeGBw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\SzivTOF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GVpIiRw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\hOgJXTf.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\NNLWZYK.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ohMybxM.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\lJYHBuZ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\QYKdoaz.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fVhKlPv.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\rgrpmIn.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\YecQgpS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\YqcGejd.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\yDVFumh.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\gfOVinF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ywEeOiw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\UZStofu.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\obRDuko.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\eUTaqHS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\DxqGrSv.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\CchUNty.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\NyIRjLr.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\nnHUlFf.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\pMuoszI.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\RBfLIaT.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\KVkhCsa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fPwxPIe.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\cyvKNNr.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\sRGcHoF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\kIgzALm.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ECapnpH.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\QtwfRFg.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\FuoLasb.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\xshLpaS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\iixHoNM.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\THfiMla.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\QiatAfS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\joSQTZa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\wEFGwHa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\XTcsCbX.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GxXQNdc.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\vvtcqzT.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\CujAXDQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\kdCFihw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\oGINvYB.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\MYUNGiW.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\pxCiuFf.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\hXBFGjQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\gxEilsu.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GqNJaGQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\AnGOsEs.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Token: SeDebugPrivilege	1596	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1596	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	85
PID 564 wrote to memory of 1596	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	85
PID 564 wrote to memory of 4964	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	86
PID 564 wrote to memory of 4964	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	86
PID 564 wrote to memory of 1404	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	87
PID 564 wrote to memory of 1404	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	87
PID 564 wrote to memory of 3664	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	88
PID 564 wrote to memory of 3664	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	88
PID 564 wrote to memory of 3512	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	89
PID 564 wrote to memory of 3512	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	89
PID 564 wrote to memory of 1676	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	90
PID 564 wrote to memory of 1676	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	90
PID 564 wrote to memory of 3128	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	91
PID 564 wrote to memory of 3128	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	91
PID 564 wrote to memory of 3896	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	92
PID 564 wrote to memory of 3896	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	92
PID 564 wrote to memory of 3560	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	93
PID 564 wrote to memory of 3560	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	93
PID 564 wrote to memory of 4048	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	94
PID 564 wrote to memory of 4048	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	94
PID 564 wrote to memory of 3068	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	95
PID 564 wrote to memory of 3068	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	95
PID 564 wrote to memory of 2972	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	96
PID 564 wrote to memory of 2972	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	96
PID 564 wrote to memory of 1268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	97
PID 564 wrote to memory of 1268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	97
PID 564 wrote to memory of 368	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	98
PID 564 wrote to memory of 368	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	98
PID 564 wrote to memory of 3328	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	99
PID 564 wrote to memory of 3328	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	99
PID 564 wrote to memory of 4300	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	100
PID 564 wrote to memory of 4300	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	100
PID 564 wrote to memory of 4516	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	101
PID 564 wrote to memory of 4516	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	101
PID 564 wrote to memory of 3424	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	102
PID 564 wrote to memory of 3424	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	102
PID 564 wrote to memory of 1576	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	103
PID 564 wrote to memory of 1576	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	103
PID 564 wrote to memory of 2268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	104
PID 564 wrote to memory of 2268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	104
PID 564 wrote to memory of 3564	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	105
PID 564 wrote to memory of 3564	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	105
PID 564 wrote to memory of 1220	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	106
PID 564 wrote to memory of 1220	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	106
PID 564 wrote to memory of 3832	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	107
PID 564 wrote to memory of 3832	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	107
PID 564 wrote to memory of 3076	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	108
PID 564 wrote to memory of 3076	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	108
PID 564 wrote to memory of 4848	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	109
PID 564 wrote to memory of 4848	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	109
PID 564 wrote to memory of 4372	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	110
PID 564 wrote to memory of 4372	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	110
PID 564 wrote to memory of 1884	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	111
PID 564 wrote to memory of 1884	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	111
PID 564 wrote to memory of 1868	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	112
PID 564 wrote to memory of 1868	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	112
PID 564 wrote to memory of 4864	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	113
PID 564 wrote to memory of 4864	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	113
PID 564 wrote to memory of 2412	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	114
PID 564 wrote to memory of 2412	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	114
PID 564 wrote to memory of 2540	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	115
PID 564 wrote to memory of 2540	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	115
PID 564 wrote to memory of 2264	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	116
PID 564 wrote to memory of 2264	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\System\PHzWtGZ.exe
  C:\Windows\System\PHzWtGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\WdmYsCJ.exe
  C:\Windows\System\WdmYsCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\ixKnPdR.exe
  C:\Windows\System\ixKnPdR.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\VdTLFnl.exe
  C:\Windows\System\VdTLFnl.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\xSubBrr.exe
  C:\Windows\System\xSubBrr.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\Tiexlvh.exe
  C:\Windows\System\Tiexlvh.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\iyrGRee.exe
  C:\Windows\System\iyrGRee.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\iLtWcAs.exe
  C:\Windows\System\iLtWcAs.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\KKoAfPw.exe
  C:\Windows\System\KKoAfPw.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\sFnbeRF.exe
  C:\Windows\System\sFnbeRF.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\lSReJmJ.exe
  C:\Windows\System\lSReJmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\nliYJCC.exe
  C:\Windows\System\nliYJCC.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\BLjkpgj.exe
  C:\Windows\System\BLjkpgj.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\anMJFkE.exe
  C:\Windows\System\anMJFkE.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\BKTSbxC.exe
  C:\Windows\System\BKTSbxC.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\VCFKiPH.exe
  C:\Windows\System\VCFKiPH.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\WuwiegC.exe
  C:\Windows\System\WuwiegC.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\FRLvPWF.exe
  C:\Windows\System\FRLvPWF.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\jEJXgNg.exe
  C:\Windows\System\jEJXgNg.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ielurPd.exe
  C:\Windows\System\ielurPd.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\YyNOLXU.exe
  C:\Windows\System\YyNOLXU.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\ajazpdD.exe
  C:\Windows\System\ajazpdD.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\QvBHgcJ.exe
  C:\Windows\System\QvBHgcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\HlAZIBO.exe
  C:\Windows\System\HlAZIBO.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\UtGyPQj.exe
  C:\Windows\System\UtGyPQj.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\aXVduOR.exe
  C:\Windows\System\aXVduOR.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\DdIBLuI.exe
  C:\Windows\System\DdIBLuI.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\nmbPpuW.exe
  C:\Windows\System\nmbPpuW.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\onevXfS.exe
  C:\Windows\System\onevXfS.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\wsGDcbN.exe
  C:\Windows\System\wsGDcbN.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\fulODJi.exe
  C:\Windows\System\fulODJi.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\XnhbrWW.exe
  C:\Windows\System\XnhbrWW.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\nLQXojG.exe
  C:\Windows\System\nLQXojG.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\xVPqpjl.exe
  C:\Windows\System\xVPqpjl.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\siKWGMH.exe
  C:\Windows\System\siKWGMH.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\BMOtGzB.exe
  C:\Windows\System\BMOtGzB.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\amLkRIl.exe
  C:\Windows\System\amLkRIl.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\qNHlgDC.exe
  C:\Windows\System\qNHlgDC.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\EwQZJCd.exe
  C:\Windows\System\EwQZJCd.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\kIaniBl.exe
  C:\Windows\System\kIaniBl.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\ZPuhGCQ.exe
  C:\Windows\System\ZPuhGCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\fHPoHlx.exe
  C:\Windows\System\fHPoHlx.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\dYvtyox.exe
  C:\Windows\System\dYvtyox.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\MsuVtiR.exe
  C:\Windows\System\MsuVtiR.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\dSjnMLc.exe
  C:\Windows\System\dSjnMLc.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\KjTCKRp.exe
  C:\Windows\System\KjTCKRp.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\dHfoSpC.exe
  C:\Windows\System\dHfoSpC.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\qUmLncM.exe
  C:\Windows\System\qUmLncM.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\QGVwqTb.exe
  C:\Windows\System\QGVwqTb.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\ViMegpl.exe
  C:\Windows\System\ViMegpl.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\CMKljQa.exe
  C:\Windows\System\CMKljQa.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\iCdQGRB.exe
  C:\Windows\System\iCdQGRB.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\PIrhwHX.exe
  C:\Windows\System\PIrhwHX.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\kOlSIbr.exe
  C:\Windows\System\kOlSIbr.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\buQBjKa.exe
  C:\Windows\System\buQBjKa.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\RzoExBT.exe
  C:\Windows\System\RzoExBT.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\uUgcsDr.exe
  C:\Windows\System\uUgcsDr.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\HBSGzgg.exe
  C:\Windows\System\HBSGzgg.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\ImXIHiN.exe
  C:\Windows\System\ImXIHiN.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\rfCkhuM.exe
  C:\Windows\System\rfCkhuM.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\FARscMv.exe
  C:\Windows\System\FARscMv.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\pALXsXp.exe
  C:\Windows\System\pALXsXp.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\WXgzLGe.exe
  C:\Windows\System\WXgzLGe.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\KmPSIsY.exe
  C:\Windows\System\KmPSIsY.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\QsJoWZz.exe
  C:\Windows\System\QsJoWZz.exe
  2⤵
  PID:888
- C:\Windows\System\exZIdFy.exe
  C:\Windows\System\exZIdFy.exe
  2⤵
  PID:2448
- C:\Windows\System\PkKSgmQ.exe
  C:\Windows\System\PkKSgmQ.exe
  2⤵
  PID:1408
- C:\Windows\System\mEESJOp.exe
  C:\Windows\System\mEESJOp.exe
  2⤵
  PID:2668
- C:\Windows\System\cBfUMnu.exe
  C:\Windows\System\cBfUMnu.exe
  2⤵
  PID:4960
- C:\Windows\System\zVXjZnb.exe
  C:\Windows\System\zVXjZnb.exe
  2⤵
  PID:1960
- C:\Windows\System\HOohTBY.exe
  C:\Windows\System\HOohTBY.exe
  2⤵
  PID:2148
- C:\Windows\System\ubsGBWY.exe
  C:\Windows\System\ubsGBWY.exe
  2⤵
  PID:3056
- C:\Windows\System\UmpZiWW.exe
  C:\Windows\System\UmpZiWW.exe
  2⤵
  PID:4540
- C:\Windows\System\jhIdopV.exe
  C:\Windows\System\jhIdopV.exe
  2⤵
  PID:5144
- C:\Windows\System\GUsLgoV.exe
  C:\Windows\System\GUsLgoV.exe
  2⤵
  PID:5172
- C:\Windows\System\WzgettC.exe
  C:\Windows\System\WzgettC.exe
  2⤵
  PID:5200
- C:\Windows\System\sNwrFYp.exe
  C:\Windows\System\sNwrFYp.exe
  2⤵
  PID:5224
- C:\Windows\System\uUqdrLk.exe
  C:\Windows\System\uUqdrLk.exe
  2⤵
  PID:5252
- C:\Windows\System\tQEquTJ.exe
  C:\Windows\System\tQEquTJ.exe
  2⤵
  PID:5280
- C:\Windows\System\PHcqrIm.exe
  C:\Windows\System\PHcqrIm.exe
  2⤵
  PID:5308
- C:\Windows\System\KyPbyMK.exe
  C:\Windows\System\KyPbyMK.exe
  2⤵
  PID:5336
- C:\Windows\System\hWnAVkn.exe
  C:\Windows\System\hWnAVkn.exe
  2⤵
  PID:5360
- C:\Windows\System\dlshDDC.exe
  C:\Windows\System\dlshDDC.exe
  2⤵
  PID:5392
- C:\Windows\System\dGVeNWe.exe
  C:\Windows\System\dGVeNWe.exe
  2⤵
  PID:5416
- C:\Windows\System\qiKINer.exe
  C:\Windows\System\qiKINer.exe
  2⤵
  PID:5444
- C:\Windows\System\mIfcQyK.exe
  C:\Windows\System\mIfcQyK.exe
  2⤵
  PID:5472
- C:\Windows\System\NPbqepw.exe
  C:\Windows\System\NPbqepw.exe
  2⤵
  PID:5504
- C:\Windows\System\exhzRfw.exe
  C:\Windows\System\exhzRfw.exe
  2⤵
  PID:5532
- C:\Windows\System\lVUHjpe.exe
  C:\Windows\System\lVUHjpe.exe
  2⤵
  PID:5560
- C:\Windows\System\RNZqyrf.exe
  C:\Windows\System\RNZqyrf.exe
  2⤵
  PID:5588
- C:\Windows\System\olagvhD.exe
  C:\Windows\System\olagvhD.exe
  2⤵
  PID:5620
- C:\Windows\System\irKBWHY.exe
  C:\Windows\System\irKBWHY.exe
  2⤵
  PID:5644
- C:\Windows\System\iyzTbyO.exe
  C:\Windows\System\iyzTbyO.exe
  2⤵
  PID:5672
- C:\Windows\System\IQKHihz.exe
  C:\Windows\System\IQKHihz.exe
  2⤵
  PID:5700
- C:\Windows\System\KWrNBvG.exe
  C:\Windows\System\KWrNBvG.exe
  2⤵
  PID:5728
- C:\Windows\System\PEkInJG.exe
  C:\Windows\System\PEkInJG.exe
  2⤵
  PID:5756
- C:\Windows\System\YTtsyeg.exe
  C:\Windows\System\YTtsyeg.exe
  2⤵
  PID:5784
- C:\Windows\System\qNyThbT.exe
  C:\Windows\System\qNyThbT.exe
  2⤵
  PID:5812
- C:\Windows\System\BdlWaDu.exe
  C:\Windows\System\BdlWaDu.exe
  2⤵
  PID:5840
- C:\Windows\System\XmWwzuM.exe
  C:\Windows\System\XmWwzuM.exe
  2⤵
  PID:5864
- C:\Windows\System\ILmTMHq.exe
  C:\Windows\System\ILmTMHq.exe
  2⤵
  PID:5916
- C:\Windows\System\fLSbpnQ.exe
  C:\Windows\System\fLSbpnQ.exe
  2⤵
  PID:5944
- C:\Windows\System\QBCiqbN.exe
  C:\Windows\System\QBCiqbN.exe
  2⤵
  PID:5960
- C:\Windows\System\RzVvFYi.exe
  C:\Windows\System\RzVvFYi.exe
  2⤵
  PID:5984
- C:\Windows\System\BQEPZLM.exe
  C:\Windows\System\BQEPZLM.exe
  2⤵
  PID:6012
- C:\Windows\System\JJWxqtA.exe
  C:\Windows\System\JJWxqtA.exe
  2⤵
  PID:6040
- C:\Windows\System\FMVhhJo.exe
  C:\Windows\System\FMVhhJo.exe
  2⤵
  PID:6068
- C:\Windows\System\mCJoMEu.exe
  C:\Windows\System\mCJoMEu.exe
  2⤵
  PID:6088
- C:\Windows\System\ZMwCWIv.exe
  C:\Windows\System\ZMwCWIv.exe
  2⤵
  PID:6116
- C:\Windows\System\sZKLbyH.exe
  C:\Windows\System\sZKLbyH.exe
  2⤵
  PID:4452
- C:\Windows\System\hYrDqCl.exe
  C:\Windows\System\hYrDqCl.exe
  2⤵
  PID:4704
- C:\Windows\System\LbWKcEm.exe
  C:\Windows\System\LbWKcEm.exe
  2⤵
  PID:1188
- C:\Windows\System\UZStofu.exe
  C:\Windows\System\UZStofu.exe
  2⤵
  PID:2260
- C:\Windows\System\eHbcYII.exe
  C:\Windows\System\eHbcYII.exe
  2⤵
  PID:5124
- C:\Windows\System\pFLkdXl.exe
  C:\Windows\System\pFLkdXl.exe
  2⤵
  PID:5188
- C:\Windows\System\xgPkxkm.exe
  C:\Windows\System\xgPkxkm.exe
  2⤵
  PID:5260
- C:\Windows\System\AZuBqQR.exe
  C:\Windows\System\AZuBqQR.exe
  2⤵
  PID:5300
- C:\Windows\System\bjVKxAK.exe
  C:\Windows\System\bjVKxAK.exe
  2⤵
  PID:5372
- C:\Windows\System\TfvqteI.exe
  C:\Windows\System\TfvqteI.exe
  2⤵
  PID:5408
- C:\Windows\System\CnhmADG.exe
  C:\Windows\System\CnhmADG.exe
  2⤵
  PID:5484
- C:\Windows\System\mpzbbqx.exe
  C:\Windows\System\mpzbbqx.exe
  2⤵
  PID:5524
- C:\Windows\System\JpDNbMW.exe
  C:\Windows\System\JpDNbMW.exe
  2⤵
  PID:5580
- C:\Windows\System\BVixYQS.exe
  C:\Windows\System\BVixYQS.exe
  2⤵
  PID:5632
- C:\Windows\System\VdmwKKM.exe
  C:\Windows\System\VdmwKKM.exe
  2⤵
  PID:5692
- C:\Windows\System\ofnkTtQ.exe
  C:\Windows\System\ofnkTtQ.exe
  2⤵
  PID:5744
- C:\Windows\System\fBkEqmt.exe
  C:\Windows\System\fBkEqmt.exe
  2⤵
  PID:5804
- C:\Windows\System\prlBylx.exe
  C:\Windows\System\prlBylx.exe
  2⤵
  PID:5860
- C:\Windows\System\eFLBxLz.exe
  C:\Windows\System\eFLBxLz.exe
  2⤵
  PID:5932
- C:\Windows\System\OcBBJbt.exe
  C:\Windows\System\OcBBJbt.exe
  2⤵
  PID:952
- C:\Windows\System\dxzxwWc.exe
  C:\Windows\System\dxzxwWc.exe
  2⤵
  PID:6036
- C:\Windows\System\OigaCCt.exe
  C:\Windows\System\OigaCCt.exe
  2⤵
  PID:6100
- C:\Windows\System\NdzAUin.exe
  C:\Windows\System\NdzAUin.exe
  2⤵
  PID:5152
- C:\Windows\System\qkHmTVW.exe
  C:\Windows\System\qkHmTVW.exe
  2⤵
  PID:5288
- C:\Windows\System\wGdMwjU.exe
  C:\Windows\System\wGdMwjU.exe
  2⤵
  PID:5328
- C:\Windows\System\RdKXTkx.exe
  C:\Windows\System\RdKXTkx.exe
  2⤵
  PID:4940
- C:\Windows\System\luILCam.exe
  C:\Windows\System\luILCam.exe
  2⤵
  PID:3116
- C:\Windows\System\GpUBIRf.exe
  C:\Windows\System\GpUBIRf.exe
  2⤵
  PID:5492
- C:\Windows\System\IxONPkb.exe
  C:\Windows\System\IxONPkb.exe
  2⤵
  PID:5604
- C:\Windows\System\xLcVgYa.exe
  C:\Windows\System\xLcVgYa.exe
  2⤵
  PID:2104
- C:\Windows\System\ymwXElF.exe
  C:\Windows\System\ymwXElF.exe
  2⤵
  PID:5720
- C:\Windows\System\gTQSyrN.exe
  C:\Windows\System\gTQSyrN.exe
  2⤵
  PID:5800
- C:\Windows\System\uEKcjmI.exe
  C:\Windows\System\uEKcjmI.exe
  2⤵
  PID:5848
- C:\Windows\System\NokVvEj.exe
  C:\Windows\System\NokVvEj.exe
  2⤵
  PID:4136
- C:\Windows\System\kkOPFbj.exe
  C:\Windows\System\kkOPFbj.exe
  2⤵
  PID:2736
- C:\Windows\System\TcTfhAl.exe
  C:\Windows\System\TcTfhAl.exe
  2⤵
  PID:3992
- C:\Windows\System\vuaezZP.exe
  C:\Windows\System\vuaezZP.exe
  2⤵
  PID:6008
- C:\Windows\System\KvFtTUy.exe
  C:\Windows\System\KvFtTUy.exe
  2⤵
  PID:3052
- C:\Windows\System\EjPttYY.exe
  C:\Windows\System\EjPttYY.exe
  2⤵
  PID:4088
- C:\Windows\System\exjHEDY.exe
  C:\Windows\System\exjHEDY.exe
  2⤵
  PID:3272
- C:\Windows\System\iIJYOXI.exe
  C:\Windows\System\iIJYOXI.exe
  2⤵
  PID:1668
- C:\Windows\System\LxrwUvT.exe
  C:\Windows\System\LxrwUvT.exe
  2⤵
  PID:5680
- C:\Windows\System\BJtFaKs.exe
  C:\Windows\System\BJtFaKs.exe
  2⤵
  PID:5664
- C:\Windows\System\bHcjxSq.exe
  C:\Windows\System\bHcjxSq.exe
  2⤵
  PID:2004
- C:\Windows\System\zbUEGuj.exe
  C:\Windows\System\zbUEGuj.exe
  2⤵
  PID:3920
- C:\Windows\System\URjYMGL.exe
  C:\Windows\System\URjYMGL.exe
  2⤵
  PID:6152
- C:\Windows\System\nVbRhZR.exe
  C:\Windows\System\nVbRhZR.exe
  2⤵
  PID:6168
- C:\Windows\System\ORRfQIo.exe
  C:\Windows\System\ORRfQIo.exe
  2⤵
  PID:6196
- C:\Windows\System\cfTKXqR.exe
  C:\Windows\System\cfTKXqR.exe
  2⤵
  PID:6224
- C:\Windows\System\dFSvaul.exe
  C:\Windows\System\dFSvaul.exe
  2⤵
  PID:6276
- C:\Windows\System\XFiWESb.exe
  C:\Windows\System\XFiWESb.exe
  2⤵
  PID:6312
- C:\Windows\System\iqkFjZC.exe
  C:\Windows\System\iqkFjZC.exe
  2⤵
  PID:6356
- C:\Windows\System\ORwYxFe.exe
  C:\Windows\System\ORwYxFe.exe
  2⤵
  PID:6384
- C:\Windows\System\OPUXyXv.exe
  C:\Windows\System\OPUXyXv.exe
  2⤵
  PID:6408
- C:\Windows\System\decmXye.exe
  C:\Windows\System\decmXye.exe
  2⤵
  PID:6440
- C:\Windows\System\dVUsgoW.exe
  C:\Windows\System\dVUsgoW.exe
  2⤵
  PID:6472
- C:\Windows\System\EDnDpHp.exe
  C:\Windows\System\EDnDpHp.exe
  2⤵
  PID:6524
- C:\Windows\System\kVBtmwb.exe
  C:\Windows\System\kVBtmwb.exe
  2⤵
  PID:6564
- C:\Windows\System\prwRkFl.exe
  C:\Windows\System\prwRkFl.exe
  2⤵
  PID:6608
- C:\Windows\System\dAolykz.exe
  C:\Windows\System\dAolykz.exe
  2⤵
  PID:6636
- C:\Windows\System\izSPxnc.exe
  C:\Windows\System\izSPxnc.exe
  2⤵
  PID:6660
- C:\Windows\System\YYeNulk.exe
  C:\Windows\System\YYeNulk.exe
  2⤵
  PID:6696
- C:\Windows\System\UCRLONT.exe
  C:\Windows\System\UCRLONT.exe
  2⤵
  PID:6720
- C:\Windows\System\vuYqtrk.exe
  C:\Windows\System\vuYqtrk.exe
  2⤵
  PID:6736
- C:\Windows\System\HxLwODh.exe
  C:\Windows\System\HxLwODh.exe
  2⤵
  PID:6756
- C:\Windows\System\VPlOgsD.exe
  C:\Windows\System\VPlOgsD.exe
  2⤵
  PID:6772
- C:\Windows\System\DmSaGim.exe
  C:\Windows\System\DmSaGim.exe
  2⤵
  PID:6788
- C:\Windows\System\leVoIPp.exe
  C:\Windows\System\leVoIPp.exe
  2⤵
  PID:6816
- C:\Windows\System\lMCTkKQ.exe
  C:\Windows\System\lMCTkKQ.exe
  2⤵
  PID:6848
- C:\Windows\System\wLJUPJi.exe
  C:\Windows\System\wLJUPJi.exe
  2⤵
  PID:6868
- C:\Windows\System\cFseGzM.exe
  C:\Windows\System\cFseGzM.exe
  2⤵
  PID:6904
- C:\Windows\System\ciQSBEw.exe
  C:\Windows\System\ciQSBEw.exe
  2⤵
  PID:6932
- C:\Windows\System\AVrxgFk.exe
  C:\Windows\System\AVrxgFk.exe
  2⤵
  PID:6992
- C:\Windows\System\Turhyhk.exe
  C:\Windows\System\Turhyhk.exe
  2⤵
  PID:7012
- C:\Windows\System\yYxJMfa.exe
  C:\Windows\System\yYxJMfa.exe
  2⤵
  PID:7040
- C:\Windows\System\SNggpFK.exe
  C:\Windows\System\SNggpFK.exe
  2⤵
  PID:7084
- C:\Windows\System\mBYGzKN.exe
  C:\Windows\System\mBYGzKN.exe
  2⤵
  PID:7108
- C:\Windows\System\gDtgNkJ.exe
  C:\Windows\System\gDtgNkJ.exe
  2⤵
  PID:7128
- C:\Windows\System\QZEyQNb.exe
  C:\Windows\System\QZEyQNb.exe
  2⤵
  PID:7152
- C:\Windows\System\uCIVuYO.exe
  C:\Windows\System\uCIVuYO.exe
  2⤵
  PID:5568
- C:\Windows\System\mhGRKdU.exe
  C:\Windows\System\mhGRKdU.exe
  2⤵
  PID:2680
- C:\Windows\System\gkfXMPA.exe
  C:\Windows\System\gkfXMPA.exe
  2⤵
  PID:6180
- C:\Windows\System\BITBqHn.exe
  C:\Windows\System\BITBqHn.exe
  2⤵
  PID:6216
- C:\Windows\System\MJaePOj.exe
  C:\Windows\System\MJaePOj.exe
  2⤵
  PID:3468
- C:\Windows\System\OBMDamw.exe
  C:\Windows\System\OBMDamw.exe
  2⤵
  PID:6348
- C:\Windows\System\MhjYgfH.exe
  C:\Windows\System\MhjYgfH.exe
  2⤵
  PID:6392
- C:\Windows\System\YgUJZKd.exe
  C:\Windows\System\YgUJZKd.exe
  2⤵
  PID:6532
- C:\Windows\System\eUYivZo.exe
  C:\Windows\System\eUYivZo.exe
  2⤵
  PID:3196
- C:\Windows\System\qNkIlLa.exe
  C:\Windows\System\qNkIlLa.exe
  2⤵
  PID:6628
- C:\Windows\System\MeeImrh.exe
  C:\Windows\System\MeeImrh.exe
  2⤵
  PID:6684
- C:\Windows\System\KFfiUwC.exe
  C:\Windows\System\KFfiUwC.exe
  2⤵
  PID:6732
- C:\Windows\System\IekMkIQ.exe
  C:\Windows\System\IekMkIQ.exe
  2⤵
  PID:6780
- C:\Windows\System\nCDOHRD.exe
  C:\Windows\System\nCDOHRD.exe
  2⤵
  PID:4660
- C:\Windows\System\nVThxTN.exe
  C:\Windows\System\nVThxTN.exe
  2⤵
  PID:6912
- C:\Windows\System\XLBzFwA.exe
  C:\Windows\System\XLBzFwA.exe
  2⤵
  PID:6960
- C:\Windows\System\AhIizrv.exe
  C:\Windows\System\AhIizrv.exe
  2⤵
  PID:4152
- C:\Windows\System\GVQHqqn.exe
  C:\Windows\System\GVQHqqn.exe
  2⤵
  PID:4020
- C:\Windows\System\eeQfOOJ.exe
  C:\Windows\System\eeQfOOJ.exe
  2⤵
  PID:7072
- C:\Windows\System\LRjqPkS.exe
  C:\Windows\System\LRjqPkS.exe
  2⤵
  PID:6232
- C:\Windows\System\skhCjkP.exe
  C:\Windows\System\skhCjkP.exe
  2⤵
  PID:6212
- C:\Windows\System\kbhaeMw.exe
  C:\Windows\System\kbhaeMw.exe
  2⤵
  PID:6336
- C:\Windows\System\GJmKkbs.exe
  C:\Windows\System\GJmKkbs.exe
  2⤵
  PID:4888
- C:\Windows\System\cuenYvN.exe
  C:\Windows\System\cuenYvN.exe
  2⤵
  PID:6488
- C:\Windows\System\RsnGfxW.exe
  C:\Windows\System\RsnGfxW.exe
  2⤵
  PID:6604
- C:\Windows\System\CSJfnIu.exe
  C:\Windows\System\CSJfnIu.exe
  2⤵
  PID:6924
- C:\Windows\System\iCkdzQy.exe
  C:\Windows\System\iCkdzQy.exe
  2⤵
  PID:5164
- C:\Windows\System\OONJoPZ.exe
  C:\Windows\System\OONJoPZ.exe
  2⤵
  PID:7104
- C:\Windows\System\CDmaSXN.exe
  C:\Windows\System\CDmaSXN.exe
  2⤵
  PID:6176
- C:\Windows\System\nKPnSvt.exe
  C:\Windows\System\nKPnSvt.exe
  2⤵
  PID:6576
- C:\Windows\System\fikeGBw.exe
  C:\Windows\System\fikeGBw.exe
  2⤵
  PID:6656
- C:\Windows\System\Aahhbmi.exe
  C:\Windows\System\Aahhbmi.exe
  2⤵
  PID:6836
- C:\Windows\System\SROtKEX.exe
  C:\Windows\System\SROtKEX.exe
  2⤵
  PID:5552
- C:\Windows\System\hbnkSTe.exe
  C:\Windows\System\hbnkSTe.exe
  2⤵
  PID:4740
- C:\Windows\System\xdYktgY.exe
  C:\Windows\System\xdYktgY.exe
  2⤵
  PID:6372
- C:\Windows\System\NXvAlGW.exe
  C:\Windows\System\NXvAlGW.exe
  2⤵
  PID:3124
- C:\Windows\System\cfgYyIk.exe
  C:\Windows\System\cfgYyIk.exe
  2⤵
  PID:7184
- C:\Windows\System\RBhzvhn.exe
  C:\Windows\System\RBhzvhn.exe
  2⤵
  PID:7208
- C:\Windows\System\pWitmWK.exe
  C:\Windows\System\pWitmWK.exe
  2⤵
  PID:7272
- C:\Windows\System\cMHjxeQ.exe
  C:\Windows\System\cMHjxeQ.exe
  2⤵
  PID:7316
- C:\Windows\System\dKKyNfe.exe
  C:\Windows\System\dKKyNfe.exe
  2⤵
  PID:7332
- C:\Windows\System\WplzfTm.exe
  C:\Windows\System\WplzfTm.exe
  2⤵
  PID:7356
- C:\Windows\System\dHlMARi.exe
  C:\Windows\System\dHlMARi.exe
  2⤵
  PID:7388
- C:\Windows\System\MWvxoMi.exe
  C:\Windows\System\MWvxoMi.exe
  2⤵
  PID:7420
- C:\Windows\System\imJaiRi.exe
  C:\Windows\System\imJaiRi.exe
  2⤵
  PID:7436
- C:\Windows\System\tlcKhKj.exe
  C:\Windows\System\tlcKhKj.exe
  2⤵
  PID:7460
- C:\Windows\System\dVznjOy.exe
  C:\Windows\System\dVznjOy.exe
  2⤵
  PID:7480
- C:\Windows\System\TdXgPfU.exe
  C:\Windows\System\TdXgPfU.exe
  2⤵
  PID:7504
- C:\Windows\System\kcYrBhj.exe
  C:\Windows\System\kcYrBhj.exe
  2⤵
  PID:7524
- C:\Windows\System\OPSIsVa.exe
  C:\Windows\System\OPSIsVa.exe
  2⤵
  PID:7544
- C:\Windows\System\rIBcFlc.exe
  C:\Windows\System\rIBcFlc.exe
  2⤵
  PID:7588
- C:\Windows\System\amqfEeX.exe
  C:\Windows\System\amqfEeX.exe
  2⤵
  PID:7616
- C:\Windows\System\bCmDXrU.exe
  C:\Windows\System\bCmDXrU.exe
  2⤵
  PID:7672
- C:\Windows\System\rhNjuyy.exe
  C:\Windows\System\rhNjuyy.exe
  2⤵
  PID:7688
- C:\Windows\System\tBWRmFo.exe
  C:\Windows\System\tBWRmFo.exe
  2⤵
  PID:7728
- C:\Windows\System\pvNEGxR.exe
  C:\Windows\System\pvNEGxR.exe
  2⤵
  PID:7752
- C:\Windows\System\yYGIpSd.exe
  C:\Windows\System\yYGIpSd.exe
  2⤵
  PID:7780
- C:\Windows\System\dCqUmmW.exe
  C:\Windows\System\dCqUmmW.exe
  2⤵
  PID:7804
- C:\Windows\System\QIdDRct.exe
  C:\Windows\System\QIdDRct.exe
  2⤵
  PID:7824
- C:\Windows\System\cUFWUCU.exe
  C:\Windows\System\cUFWUCU.exe
  2⤵
  PID:7856
- C:\Windows\System\TKfZBYb.exe
  C:\Windows\System\TKfZBYb.exe
  2⤵
  PID:7884
- C:\Windows\System\GZxvIad.exe
  C:\Windows\System\GZxvIad.exe
  2⤵
  PID:7912
- C:\Windows\System\SGgdvup.exe
  C:\Windows\System\SGgdvup.exe
  2⤵
  PID:7936
- C:\Windows\System\fjrvqJq.exe
  C:\Windows\System\fjrvqJq.exe
  2⤵
  PID:7992
- C:\Windows\System\uFlnOIq.exe
  C:\Windows\System\uFlnOIq.exe
  2⤵
  PID:8012
- C:\Windows\System\tnuwBpX.exe
  C:\Windows\System\tnuwBpX.exe
  2⤵
  PID:8052
- C:\Windows\System\BIDDBen.exe
  C:\Windows\System\BIDDBen.exe
  2⤵
  PID:8072
- C:\Windows\System\moSbXKV.exe
  C:\Windows\System\moSbXKV.exe
  2⤵
  PID:8088
- C:\Windows\System\vVZhvxR.exe
  C:\Windows\System\vVZhvxR.exe
  2⤵
  PID:8128
- C:\Windows\System\qNaHKTK.exe
  C:\Windows\System\qNaHKTK.exe
  2⤵
  PID:8156
- C:\Windows\System\ZUtCnXq.exe
  C:\Windows\System\ZUtCnXq.exe
  2⤵
  PID:8180
- C:\Windows\System\bFSSRWn.exe
  C:\Windows\System\bFSSRWn.exe
  2⤵
  PID:4204
- C:\Windows\System\dfEWErI.exe
  C:\Windows\System\dfEWErI.exe
  2⤵
  PID:7172
- C:\Windows\System\AjiIJPa.exe
  C:\Windows\System\AjiIJPa.exe
  2⤵
  PID:7192
- C:\Windows\System\XtLBECd.exe
  C:\Windows\System\XtLBECd.exe
  2⤵
  PID:7312
- C:\Windows\System\yxBOaoj.exe
  C:\Windows\System\yxBOaoj.exe
  2⤵
  PID:7384
- C:\Windows\System\jMCPbsZ.exe
  C:\Windows\System\jMCPbsZ.exe
  2⤵
  PID:7492
- C:\Windows\System\uSfPznU.exe
  C:\Windows\System\uSfPznU.exe
  2⤵
  PID:7532
- C:\Windows\System\QUydKfS.exe
  C:\Windows\System\QUydKfS.exe
  2⤵
  PID:7572
- C:\Windows\System\MPgaVYv.exe
  C:\Windows\System\MPgaVYv.exe
  2⤵
  PID:7664
- C:\Windows\System\efosCpP.exe
  C:\Windows\System\efosCpP.exe
  2⤵
  PID:7720
- C:\Windows\System\swggPlS.exe
  C:\Windows\System\swggPlS.exe
  2⤵
  PID:7832
- C:\Windows\System\jGLgxDy.exe
  C:\Windows\System\jGLgxDy.exe
  2⤵
  PID:7812
- C:\Windows\System\drRFqjy.exe
  C:\Windows\System\drRFqjy.exe
  2⤵
  PID:7880
- C:\Windows\System\CWEIXIe.exe
  C:\Windows\System\CWEIXIe.exe
  2⤵
  PID:7960
- C:\Windows\System\LUDXmgH.exe
  C:\Windows\System\LUDXmgH.exe
  2⤵
  PID:8044
- C:\Windows\System\sbDPdMb.exe
  C:\Windows\System\sbDPdMb.exe
  2⤵
  PID:8084
- C:\Windows\System\lwDkKiC.exe
  C:\Windows\System\lwDkKiC.exe
  2⤵
  PID:8136
- C:\Windows\System\rwrrHiK.exe
  C:\Windows\System\rwrrHiK.exe
  2⤵
  PID:8172
- C:\Windows\System\fqLZuyI.exe
  C:\Windows\System\fqLZuyI.exe
  2⤵
  PID:6556
- C:\Windows\System\xcvtmts.exe
  C:\Windows\System\xcvtmts.exe
  2⤵
  PID:5104
- C:\Windows\System\lrQWnDM.exe
  C:\Windows\System\lrQWnDM.exe
  2⤵
  PID:7408
- C:\Windows\System\xFqkWID.exe
  C:\Windows\System\xFqkWID.exe
  2⤵
  PID:7520
- C:\Windows\System\GAOfMHd.exe
  C:\Windows\System\GAOfMHd.exe
  2⤵
  PID:7660
- C:\Windows\System\gSZstaX.exe
  C:\Windows\System\gSZstaX.exe
  2⤵
  PID:7800
- C:\Windows\System\llWcski.exe
  C:\Windows\System\llWcski.exe
  2⤵
  PID:8024
- C:\Windows\System\vkirIqc.exe
  C:\Windows\System\vkirIqc.exe
  2⤵
  PID:7092
- C:\Windows\System\GGLVghf.exe
  C:\Windows\System\GGLVghf.exe
  2⤵
  PID:3476
- C:\Windows\System\ygaQfnK.exe
  C:\Windows\System\ygaQfnK.exe
  2⤵
  PID:7652
- C:\Windows\System\yAIUjjn.exe
  C:\Windows\System\yAIUjjn.exe
  2⤵
  PID:7820
- C:\Windows\System\YCCHUrN.exe
  C:\Windows\System\YCCHUrN.exe
  2⤵
  PID:8104
- C:\Windows\System\qpqPgHR.exe
  C:\Windows\System\qpqPgHR.exe
  2⤵
  PID:8216
- C:\Windows\System\HFcwLWb.exe
  C:\Windows\System\HFcwLWb.exe
  2⤵
  PID:8240
- C:\Windows\System\sYQjPGK.exe
  C:\Windows\System\sYQjPGK.exe
  2⤵
  PID:8276
- C:\Windows\System\vwgZOZN.exe
  C:\Windows\System\vwgZOZN.exe
  2⤵
  PID:8304
- C:\Windows\System\UyGSIHr.exe
  C:\Windows\System\UyGSIHr.exe
  2⤵
  PID:8324
- C:\Windows\System\qrHqZnI.exe
  C:\Windows\System\qrHqZnI.exe
  2⤵
  PID:8344
- C:\Windows\System\VWhhZJs.exe
  C:\Windows\System\VWhhZJs.exe
  2⤵
  PID:8376
- C:\Windows\System\QOoigPJ.exe
  C:\Windows\System\QOoigPJ.exe
  2⤵
  PID:8416
- C:\Windows\System\jATKRED.exe
  C:\Windows\System\jATKRED.exe
  2⤵
  PID:8444
- C:\Windows\System\RxfqMGd.exe
  C:\Windows\System\RxfqMGd.exe
  2⤵
  PID:8468
- C:\Windows\System\HKPJmox.exe
  C:\Windows\System\HKPJmox.exe
  2⤵
  PID:8508
- C:\Windows\System\XOcdVQD.exe
  C:\Windows\System\XOcdVQD.exe
  2⤵
  PID:8528
- C:\Windows\System\xkmbJOj.exe
  C:\Windows\System\xkmbJOj.exe
  2⤵
  PID:8552
- C:\Windows\System\MXKBhzi.exe
  C:\Windows\System\MXKBhzi.exe
  2⤵
  PID:8572
- C:\Windows\System\oRtlXAm.exe
  C:\Windows\System\oRtlXAm.exe
  2⤵
  PID:8600
- C:\Windows\System\KDsoEDC.exe
  C:\Windows\System\KDsoEDC.exe
  2⤵
  PID:8624
- C:\Windows\System\gaToTsi.exe
  C:\Windows\System\gaToTsi.exe
  2⤵
  PID:8664
- C:\Windows\System\onfYdQA.exe
  C:\Windows\System\onfYdQA.exe
  2⤵
  PID:8684
- C:\Windows\System\mQtNlIt.exe
  C:\Windows\System\mQtNlIt.exe
  2⤵
  PID:8712
- C:\Windows\System\nJEgJaI.exe
  C:\Windows\System\nJEgJaI.exe
  2⤵
  PID:8752
- C:\Windows\System\GJmlvLQ.exe
  C:\Windows\System\GJmlvLQ.exe
  2⤵
  PID:8768
- C:\Windows\System\KbBxqAt.exe
  C:\Windows\System\KbBxqAt.exe
  2⤵
  PID:8800
- C:\Windows\System\xdovxXU.exe
  C:\Windows\System\xdovxXU.exe
  2⤵
  PID:8820
- C:\Windows\System\llTtosf.exe
  C:\Windows\System\llTtosf.exe
  2⤵
  PID:8840
- C:\Windows\System\pOxGaJM.exe
  C:\Windows\System\pOxGaJM.exe
  2⤵
  PID:8892
- C:\Windows\System\vkTiGOn.exe
  C:\Windows\System\vkTiGOn.exe
  2⤵
  PID:8916
- C:\Windows\System\OLYcBUg.exe
  C:\Windows\System\OLYcBUg.exe
  2⤵
  PID:8956
- C:\Windows\System\RNVqzzE.exe
  C:\Windows\System\RNVqzzE.exe
  2⤵
  PID:8980
- C:\Windows\System\ZjfzCcO.exe
  C:\Windows\System\ZjfzCcO.exe
  2⤵
  PID:9016
- C:\Windows\System\qpVLMVt.exe
  C:\Windows\System\qpVLMVt.exe
  2⤵
  PID:9036
- C:\Windows\System\ifNlZCI.exe
  C:\Windows\System\ifNlZCI.exe
  2⤵
  PID:9076
- C:\Windows\System\eDmPrMG.exe
  C:\Windows\System\eDmPrMG.exe
  2⤵
  PID:9092
- C:\Windows\System\EBvPyaJ.exe
  C:\Windows\System\EBvPyaJ.exe
  2⤵
  PID:9108
- C:\Windows\System\QzSGbIE.exe
  C:\Windows\System\QzSGbIE.exe
  2⤵
  PID:9132
- C:\Windows\System\LQaKnSt.exe
  C:\Windows\System\LQaKnSt.exe
  2⤵
  PID:9156
- C:\Windows\System\TnTIhsp.exe
  C:\Windows\System\TnTIhsp.exe
  2⤵
  PID:9180
- C:\Windows\System\qWBabMj.exe
  C:\Windows\System\qWBabMj.exe
  2⤵
  PID:8208
- C:\Windows\System\bGOkgSB.exe
  C:\Windows\System\bGOkgSB.exe
  2⤵
  PID:8232
- C:\Windows\System\dBwGxOy.exe
  C:\Windows\System\dBwGxOy.exe
  2⤵
  PID:8272
- C:\Windows\System\DdSYlLd.exe
  C:\Windows\System\DdSYlLd.exe
  2⤵
  PID:8392
- C:\Windows\System\baPyUEr.exe
  C:\Windows\System\baPyUEr.exe
  2⤵
  PID:8456
- C:\Windows\System\TSIfsiE.exe
  C:\Windows\System\TSIfsiE.exe
  2⤵
  PID:8500
- C:\Windows\System\uJEgoch.exe
  C:\Windows\System\uJEgoch.exe
  2⤵
  PID:8540
- C:\Windows\System\fBDGQOI.exe
  C:\Windows\System\fBDGQOI.exe
  2⤵
  PID:8592
- C:\Windows\System\SCdZPpx.exe
  C:\Windows\System\SCdZPpx.exe
  2⤵
  PID:8680
- C:\Windows\System\qYDBWdb.exe
  C:\Windows\System\qYDBWdb.exe
  2⤵
  PID:8760
- C:\Windows\System\qwSuFoc.exe
  C:\Windows\System\qwSuFoc.exe
  2⤵
  PID:8792
- C:\Windows\System\hbFxqsk.exe
  C:\Windows\System\hbFxqsk.exe
  2⤵
  PID:8864
- C:\Windows\System\FCJIGvk.exe
  C:\Windows\System\FCJIGvk.exe
  2⤵
  PID:8904
- C:\Windows\System\RVcCaoY.exe
  C:\Windows\System\RVcCaoY.exe
  2⤵
  PID:9004
- C:\Windows\System\iMVdmli.exe
  C:\Windows\System\iMVdmli.exe
  2⤵
  PID:9064
- C:\Windows\System\LUWZTFr.exe
  C:\Windows\System\LUWZTFr.exe
  2⤵
  PID:9100
- C:\Windows\System\xIvuhvt.exe
  C:\Windows\System\xIvuhvt.exe
  2⤵
  PID:9152
- C:\Windows\System\VdvsfzK.exe
  C:\Windows\System\VdvsfzK.exe
  2⤵
  PID:4240
- C:\Windows\System\sbwkWpQ.exe
  C:\Windows\System\sbwkWpQ.exe
  2⤵
  PID:8484
- C:\Windows\System\dazuIqG.exe
  C:\Windows\System\dazuIqG.exe
  2⤵
  PID:8524
- C:\Windows\System\MKAoWoe.exe
  C:\Windows\System\MKAoWoe.exe
  2⤵
  PID:8776
- C:\Windows\System\AfBwERM.exe
  C:\Windows\System\AfBwERM.exe
  2⤵
  PID:8952
- C:\Windows\System\rvfOHKW.exe
  C:\Windows\System\rvfOHKW.exe
  2⤵
  PID:9120
- C:\Windows\System\YLGPDOP.exe
  C:\Windows\System\YLGPDOP.exe
  2⤵
  PID:9128
- C:\Windows\System\VHuuVqU.exe
  C:\Windows\System\VHuuVqU.exe
  2⤵
  PID:8224
- C:\Windows\System\rELAwew.exe
  C:\Windows\System\rELAwew.exe
  2⤵
  PID:8336
- C:\Windows\System\BOtVinJ.exe
  C:\Windows\System\BOtVinJ.exe
  2⤵
  PID:9084
- C:\Windows\System\TTVNoOi.exe
  C:\Windows\System\TTVNoOi.exe
  2⤵
  PID:9264
- C:\Windows\System\mFnIrol.exe
  C:\Windows\System\mFnIrol.exe
  2⤵
  PID:9280
- C:\Windows\System\EwZgZNl.exe
  C:\Windows\System\EwZgZNl.exe
  2⤵
  PID:9296
- C:\Windows\System\wGLqiaw.exe
  C:\Windows\System\wGLqiaw.exe
  2⤵
  PID:9312
- C:\Windows\System\cBeiToE.exe
  C:\Windows\System\cBeiToE.exe
  2⤵
  PID:9332
- C:\Windows\System\jIQkIMz.exe
  C:\Windows\System\jIQkIMz.exe
  2⤵
  PID:9348
- C:\Windows\System\gZffxsy.exe
  C:\Windows\System\gZffxsy.exe
  2⤵
  PID:9444
- C:\Windows\System\FWgCvMj.exe
  C:\Windows\System\FWgCvMj.exe
  2⤵
  PID:9468
- C:\Windows\System\akkhVET.exe
  C:\Windows\System\akkhVET.exe
  2⤵
  PID:9508
- C:\Windows\System\veBYaAg.exe
  C:\Windows\System\veBYaAg.exe
  2⤵
  PID:9528
- C:\Windows\System\jybCOEn.exe
  C:\Windows\System\jybCOEn.exe
  2⤵
  PID:9544
- C:\Windows\System\fQUZsCN.exe
  C:\Windows\System\fQUZsCN.exe
  2⤵
  PID:9572
- C:\Windows\System\pBvoOqF.exe
  C:\Windows\System\pBvoOqF.exe
  2⤵
  PID:9628
- C:\Windows\System\qWAxQcn.exe
  C:\Windows\System\qWAxQcn.exe
  2⤵
  PID:9656
- C:\Windows\System\PgtZvhT.exe
  C:\Windows\System\PgtZvhT.exe
  2⤵
  PID:9672
- C:\Windows\System\oxoQXEf.exe
  C:\Windows\System\oxoQXEf.exe
  2⤵
  PID:9764
- C:\Windows\System\sGAtATk.exe
  C:\Windows\System\sGAtATk.exe
  2⤵
  PID:9796
- C:\Windows\System\Dvlvmss.exe
  C:\Windows\System\Dvlvmss.exe
  2⤵
  PID:9824
- C:\Windows\System\yFnfRAK.exe
  C:\Windows\System\yFnfRAK.exe
  2⤵
  PID:9848
- C:\Windows\System\nfStHva.exe
  C:\Windows\System\nfStHva.exe
  2⤵
  PID:9868
- C:\Windows\System\vPxwiIY.exe
  C:\Windows\System\vPxwiIY.exe
  2⤵
  PID:9892
- C:\Windows\System\cOQabdx.exe
  C:\Windows\System\cOQabdx.exe
  2⤵
  PID:9908
- C:\Windows\System\otamrnY.exe
  C:\Windows\System\otamrnY.exe
  2⤵
  PID:9928
- C:\Windows\System\dyHCOJF.exe
  C:\Windows\System\dyHCOJF.exe
  2⤵
  PID:9972
- C:\Windows\System\XzpcSfH.exe
  C:\Windows\System\XzpcSfH.exe
  2⤵
  PID:9988
- C:\Windows\System\dmBWgpc.exe
  C:\Windows\System\dmBWgpc.exe
  2⤵
  PID:10012
- C:\Windows\System\KzJwOcy.exe
  C:\Windows\System\KzJwOcy.exe
  2⤵
  PID:10060
- C:\Windows\System\vVjfcAO.exe
  C:\Windows\System\vVjfcAO.exe
  2⤵
  PID:10080
- C:\Windows\System\nMBvMYb.exe
  C:\Windows\System\nMBvMYb.exe
  2⤵
  PID:10116
- C:\Windows\System\FNbtqgQ.exe
  C:\Windows\System\FNbtqgQ.exe
  2⤵
  PID:10136
- C:\Windows\System\XZMieDL.exe
  C:\Windows\System\XZMieDL.exe
  2⤵
  PID:10164
- C:\Windows\System\FLYQMxl.exe
  C:\Windows\System\FLYQMxl.exe
  2⤵
  PID:10220
- C:\Windows\System\nnkhEEv.exe
  C:\Windows\System\nnkhEEv.exe
  2⤵
  PID:10236
- C:\Windows\System\ttDhrgi.exe
  C:\Windows\System\ttDhrgi.exe
  2⤵
  PID:9244
- C:\Windows\System\eWwnzkz.exe
  C:\Windows\System\eWwnzkz.exe
  2⤵
  PID:9272
- C:\Windows\System\QhAAESS.exe
  C:\Windows\System\QhAAESS.exe
  2⤵
  PID:9396
- C:\Windows\System\XLbrvCc.exe
  C:\Windows\System\XLbrvCc.exe
  2⤵
  PID:9224
- C:\Windows\System\SAWzEUD.exe
  C:\Windows\System\SAWzEUD.exe
  2⤵
  PID:9308
- C:\Windows\System\vhnvjyJ.exe
  C:\Windows\System\vhnvjyJ.exe
  2⤵
  PID:9412
- C:\Windows\System\ShBgZaj.exe
  C:\Windows\System\ShBgZaj.exe
  2⤵
  PID:9488
- C:\Windows\System\cUTxNLF.exe
  C:\Windows\System\cUTxNLF.exe
  2⤵
  PID:9464
- C:\Windows\System\LfDelzn.exe
  C:\Windows\System\LfDelzn.exe
  2⤵
  PID:9496
- C:\Windows\System\lJGBTfI.exe
  C:\Windows\System\lJGBTfI.exe
  2⤵
  PID:9608
- C:\Windows\System\lVuSNYz.exe
  C:\Windows\System\lVuSNYz.exe
  2⤵
  PID:9616
- C:\Windows\System\WAyywMj.exe
  C:\Windows\System\WAyywMj.exe
  2⤵
  PID:9780
- C:\Windows\System\kRXoeML.exe
  C:\Windows\System\kRXoeML.exe
  2⤵
  PID:9816
- C:\Windows\System\ogUZBTs.exe
  C:\Windows\System\ogUZBTs.exe
  2⤵
  PID:9836
- C:\Windows\System\VGKMRsU.exe
  C:\Windows\System\VGKMRsU.exe
  2⤵
  PID:9880
- C:\Windows\System\oGINvYB.exe
  C:\Windows\System\oGINvYB.exe
  2⤵
  PID:9952
- C:\Windows\System\GzuzzUm.exe
  C:\Windows\System\GzuzzUm.exe
  2⤵
  PID:10036
- C:\Windows\System\ofIuNpC.exe
  C:\Windows\System\ofIuNpC.exe
  2⤵
  PID:10096
- C:\Windows\System\oKRIkkz.exe
  C:\Windows\System\oKRIkkz.exe
  2⤵
  PID:10208
- C:\Windows\System\CfBQMCn.exe
  C:\Windows\System\CfBQMCn.exe
  2⤵
  PID:9028
- C:\Windows\System\IEcOxYi.exe
  C:\Windows\System\IEcOxYi.exe
  2⤵
  PID:9368
- C:\Windows\System\OURymVH.exe
  C:\Windows\System\OURymVH.exe
  2⤵
  PID:9440
- C:\Windows\System\oMaDCZC.exe
  C:\Windows\System\oMaDCZC.exe
  2⤵
  PID:9340
- C:\Windows\System\SJdatHX.exe
  C:\Windows\System\SJdatHX.exe
  2⤵
  PID:9552
- C:\Windows\System\MpliQUt.exe
  C:\Windows\System\MpliQUt.exe
  2⤵
  PID:9668
- C:\Windows\System\zkphEXS.exe
  C:\Windows\System\zkphEXS.exe
  2⤵
  PID:9900
- C:\Windows\System\eazPFcO.exe
  C:\Windows\System\eazPFcO.exe
  2⤵
  PID:10232
- C:\Windows\System\zvOwyMb.exe
  C:\Windows\System\zvOwyMb.exe
  2⤵
  PID:9388
- C:\Windows\System\HLSZwko.exe
  C:\Windows\System\HLSZwko.exe
  2⤵
  PID:9360
- C:\Windows\System\lzZmHJB.exe
  C:\Windows\System\lzZmHJB.exe
  2⤵
  PID:9516
- C:\Windows\System\PrKLNtN.exe
  C:\Windows\System\PrKLNtN.exe
  2⤵
  PID:9956
- C:\Windows\System\EOCjXNL.exe
  C:\Windows\System\EOCjXNL.exe
  2⤵
  PID:9208
- C:\Windows\System\olsWSOn.exe
  C:\Windows\System\olsWSOn.exe
  2⤵
  PID:9876
- C:\Windows\System\zruyQyN.exe
  C:\Windows\System\zruyQyN.exe
  2⤵
  PID:10248
- C:\Windows\System\BOskROI.exe
  C:\Windows\System\BOskROI.exe
  2⤵
  PID:10308
- C:\Windows\System\QjHDJuy.exe
  C:\Windows\System\QjHDJuy.exe
  2⤵
  PID:10328
- C:\Windows\System\ntzlKwf.exe
  C:\Windows\System\ntzlKwf.exe
  2⤵
  PID:10368
- C:\Windows\System\nSpnLuH.exe
  C:\Windows\System\nSpnLuH.exe
  2⤵
  PID:10384
- C:\Windows\System\AWtFxNR.exe
  C:\Windows\System\AWtFxNR.exe
  2⤵
  PID:10404
- C:\Windows\System\BQCQBuw.exe
  C:\Windows\System\BQCQBuw.exe
  2⤵
  PID:10436
- C:\Windows\System\qBaGoeD.exe
  C:\Windows\System\qBaGoeD.exe
  2⤵
  PID:10472
- C:\Windows\System\xXfwBAB.exe
  C:\Windows\System\xXfwBAB.exe
  2⤵
  PID:10496
- C:\Windows\System\AFHcAwE.exe
  C:\Windows\System\AFHcAwE.exe
  2⤵
  PID:10512
- C:\Windows\System\WjiYwto.exe
  C:\Windows\System\WjiYwto.exe
  2⤵
  PID:10556
- C:\Windows\System\bXPauGs.exe
  C:\Windows\System\bXPauGs.exe
  2⤵
  PID:10580
- C:\Windows\System\KURsAvz.exe
  C:\Windows\System\KURsAvz.exe
  2⤵
  PID:10604
- C:\Windows\System\qECQzSJ.exe
  C:\Windows\System\qECQzSJ.exe
  2⤵
  PID:10624
- C:\Windows\System\kYRNffZ.exe
  C:\Windows\System\kYRNffZ.exe
  2⤵
  PID:10676
- C:\Windows\System\mRCWBGD.exe
  C:\Windows\System\mRCWBGD.exe
  2⤵
  PID:10692
- C:\Windows\System\HDLgeuV.exe
  C:\Windows\System\HDLgeuV.exe
  2⤵
  PID:10716
- C:\Windows\System\VUhIvXZ.exe
  C:\Windows\System\VUhIvXZ.exe
  2⤵
  PID:10744
- C:\Windows\System\hFyOnUa.exe
  C:\Windows\System\hFyOnUa.exe
  2⤵
  PID:10768
- C:\Windows\System\ndweAap.exe
  C:\Windows\System\ndweAap.exe
  2⤵
  PID:10812
- C:\Windows\System\fVhKlPv.exe
  C:\Windows\System\fVhKlPv.exe
  2⤵
  PID:10848
- C:\Windows\System\zXyNhCX.exe
  C:\Windows\System\zXyNhCX.exe
  2⤵
  PID:10864
- C:\Windows\System\evoqKLn.exe
  C:\Windows\System\evoqKLn.exe
  2⤵
  PID:10904
- C:\Windows\System\xDZKzIB.exe
  C:\Windows\System\xDZKzIB.exe
  2⤵
  PID:10920
- C:\Windows\System\gWKEetj.exe
  C:\Windows\System\gWKEetj.exe
  2⤵
  PID:10948
- C:\Windows\System\ECjCZsD.exe
  C:\Windows\System\ECjCZsD.exe
  2⤵
  PID:10968
- C:\Windows\System\XEZEigM.exe
  C:\Windows\System\XEZEigM.exe
  2⤵
  PID:10996
- C:\Windows\System\uVvWwga.exe
  C:\Windows\System\uVvWwga.exe
  2⤵
  PID:11024
- C:\Windows\System\xXtYjCQ.exe
  C:\Windows\System\xXtYjCQ.exe
  2⤵
  PID:11044
- C:\Windows\System\OHaVMeM.exe
  C:\Windows\System\OHaVMeM.exe
  2⤵
  PID:11072
- C:\Windows\System\HmEOFzX.exe
  C:\Windows\System\HmEOFzX.exe
  2⤵
  PID:11088
- C:\Windows\System\hpsEQPA.exe
  C:\Windows\System\hpsEQPA.exe
  2⤵
  PID:11112
- C:\Windows\System\elcFMOr.exe
  C:\Windows\System\elcFMOr.exe
  2⤵
  PID:11164
- C:\Windows\System\BFDKwGj.exe
  C:\Windows\System\BFDKwGj.exe
  2⤵
  PID:11188
- C:\Windows\System\SDpDejU.exe
  C:\Windows\System\SDpDejU.exe
  2⤵
  PID:11252
- C:\Windows\System\mUsUgtn.exe
  C:\Windows\System\mUsUgtn.exe
  2⤵
  PID:10048
- C:\Windows\System\AnZERhs.exe
  C:\Windows\System\AnZERhs.exe
  2⤵
  PID:9808
- C:\Windows\System\yxfbdVJ.exe
  C:\Windows\System\yxfbdVJ.exe
  2⤵
  PID:10304
- C:\Windows\System\xaGdISR.exe
  C:\Windows\System\xaGdISR.exe
  2⤵
  PID:10344
- C:\Windows\System\hYPjjRB.exe
  C:\Windows\System\hYPjjRB.exe
  2⤵
  PID:10396
- C:\Windows\System\yATtuae.exe
  C:\Windows\System\yATtuae.exe
  2⤵
  PID:10452
- C:\Windows\System\smKqlod.exe
  C:\Windows\System\smKqlod.exe
  2⤵
  PID:10492
- C:\Windows\System\MPRnrNL.exe
  C:\Windows\System\MPRnrNL.exe
  2⤵
  PID:10576
- C:\Windows\System\MbXLzsB.exe
  C:\Windows\System\MbXLzsB.exe
  2⤵
  PID:10636
- C:\Windows\System\cPHPPZE.exe
  C:\Windows\System\cPHPPZE.exe
  2⤵
  PID:10712
- C:\Windows\System\TsiLClp.exe
  C:\Windows\System\TsiLClp.exe
  2⤵
  PID:10736
- C:\Windows\System\oacFTJr.exe
  C:\Windows\System\oacFTJr.exe
  2⤵
  PID:10788
- C:\Windows\System\CcfPUUu.exe
  C:\Windows\System\CcfPUUu.exe
  2⤵
  PID:10840
- C:\Windows\System\GJcYAAe.exe
  C:\Windows\System\GJcYAAe.exe
  2⤵
  PID:10964
- C:\Windows\System\LdWTmfm.exe
  C:\Windows\System\LdWTmfm.exe
  2⤵
  PID:11012
- C:\Windows\System\bjoNKVX.exe
  C:\Windows\System\bjoNKVX.exe
  2⤵
  PID:11140
- C:\Windows\System\jqWmYaH.exe
  C:\Windows\System\jqWmYaH.exe
  2⤵
  PID:11216
- C:\Windows\System\bBZIczU.exe
  C:\Windows\System\bBZIczU.exe
  2⤵
  PID:10260
- C:\Windows\System\wxtMSzN.exe
  C:\Windows\System\wxtMSzN.exe
  2⤵
  PID:10420
- C:\Windows\System\DJWuRBd.exe
  C:\Windows\System\DJWuRBd.exe
  2⤵
  PID:10660
- C:\Windows\System\zoraQFN.exe
  C:\Windows\System\zoraQFN.exe
  2⤵
  PID:10756
- C:\Windows\System\QdgLICq.exe
  C:\Windows\System\QdgLICq.exe
  2⤵
  PID:10940
- C:\Windows\System\JwwMJWC.exe
  C:\Windows\System\JwwMJWC.exe
  2⤵
  PID:10960
- C:\Windows\System\cTaSSIM.exe
  C:\Windows\System\cTaSSIM.exe
  2⤵
  PID:11036
- C:\Windows\System\HsTMKOI.exe
  C:\Windows\System\HsTMKOI.exe
  2⤵
  PID:9856
- C:\Windows\System\cwAARgL.exe
  C:\Windows\System\cwAARgL.exe
  2⤵
  PID:10364
- C:\Windows\System\rBSKxFX.exe
  C:\Windows\System\rBSKxFX.exe
  2⤵
  PID:10884
- C:\Windows\System\pzJLJxn.exe
  C:\Windows\System\pzJLJxn.exe
  2⤵
  PID:10800
- C:\Windows\System\RCUpBXq.exe
  C:\Windows\System\RCUpBXq.exe
  2⤵
  PID:11304
- C:\Windows\System\pnLcfNq.exe
  C:\Windows\System\pnLcfNq.exe
  2⤵
  PID:11348
- C:\Windows\System\bJyWWmV.exe
  C:\Windows\System\bJyWWmV.exe
  2⤵
  PID:11368
- C:\Windows\System\OJzyACJ.exe
  C:\Windows\System\OJzyACJ.exe
  2⤵
  PID:11388
- C:\Windows\System\XYEdbFW.exe
  C:\Windows\System\XYEdbFW.exe
  2⤵
  PID:11432
- C:\Windows\System\CIkWYAg.exe
  C:\Windows\System\CIkWYAg.exe
  2⤵
  PID:11476
- C:\Windows\System\ZuqwXFM.exe
  C:\Windows\System\ZuqwXFM.exe
  2⤵
  PID:11504
- C:\Windows\System\gSmZfgS.exe
  C:\Windows\System\gSmZfgS.exe
  2⤵
  PID:11528
- C:\Windows\System\DzoGPDk.exe
  C:\Windows\System\DzoGPDk.exe
  2⤵
  PID:11548
- C:\Windows\System\AkvqliK.exe
  C:\Windows\System\AkvqliK.exe
  2⤵
  PID:11576
- C:\Windows\System\tgPSDKY.exe
  C:\Windows\System\tgPSDKY.exe
  2⤵
  PID:11608
- C:\Windows\System\NCoGCHO.exe
  C:\Windows\System\NCoGCHO.exe
  2⤵
  PID:11640
- C:\Windows\System\caonrgT.exe
  C:\Windows\System\caonrgT.exe
  2⤵
  PID:11676
- C:\Windows\System\eVfanVb.exe
  C:\Windows\System\eVfanVb.exe
  2⤵
  PID:11704
- C:\Windows\System\HIkmErd.exe
  C:\Windows\System\HIkmErd.exe
  2⤵
  PID:11744
- C:\Windows\System\QElkscy.exe
  C:\Windows\System\QElkscy.exe
  2⤵
  PID:11772
- C:\Windows\System\OWTLhOY.exe
  C:\Windows\System\OWTLhOY.exe
  2⤵
  PID:11788
- C:\Windows\System\epDGbHK.exe
  C:\Windows\System\epDGbHK.exe
  2⤵
  PID:11828
- C:\Windows\System\srRWCCN.exe
  C:\Windows\System\srRWCCN.exe
  2⤵
  PID:11852
- C:\Windows\System\efzdliq.exe
  C:\Windows\System\efzdliq.exe
  2⤵
  PID:11876
- C:\Windows\System\ePiNJAa.exe
  C:\Windows\System\ePiNJAa.exe
  2⤵
  PID:11896
- C:\Windows\System\GnlNnXq.exe
  C:\Windows\System\GnlNnXq.exe
  2⤵
  PID:11924
- C:\Windows\System\UcsiPpA.exe
  C:\Windows\System\UcsiPpA.exe
  2⤵
  PID:11944
- C:\Windows\System\yYFPNCW.exe
  C:\Windows\System\yYFPNCW.exe
  2⤵
  PID:11968
- C:\Windows\System\XcMofhk.exe
  C:\Windows\System\XcMofhk.exe
  2⤵
  PID:11988
- C:\Windows\System\EFcAOri.exe
  C:\Windows\System\EFcAOri.exe
  2⤵
  PID:12012
- C:\Windows\System\ewpABAN.exe
  C:\Windows\System\ewpABAN.exe
  2⤵
  PID:12068
- C:\Windows\System\WLALkhP.exe
  C:\Windows\System\WLALkhP.exe
  2⤵
  PID:12088
- C:\Windows\System\EnuyiEQ.exe
  C:\Windows\System\EnuyiEQ.exe
  2⤵
  PID:12116
- C:\Windows\System\YHPZKmd.exe
  C:\Windows\System\YHPZKmd.exe
  2⤵
  PID:12148
- C:\Windows\System\OXkbMtt.exe
  C:\Windows\System\OXkbMtt.exe
  2⤵
  PID:12172
- C:\Windows\System\BOqGseb.exe
  C:\Windows\System\BOqGseb.exe
  2⤵
  PID:12196
- C:\Windows\System\IeAoGFt.exe
  C:\Windows\System\IeAoGFt.exe
  2⤵
  PID:12232
- C:\Windows\System\BABAlmW.exe
  C:\Windows\System\BABAlmW.exe
  2⤵
  PID:12272
- C:\Windows\System\vuofSmv.exe
  C:\Windows\System\vuofSmv.exe
  2⤵
  PID:10596
- C:\Windows\System\zTAkNqy.exe
  C:\Windows\System\zTAkNqy.exe
  2⤵
  PID:11240
- C:\Windows\System\upgMGFi.exe
  C:\Windows\System\upgMGFi.exe
  2⤵
  PID:11332
- C:\Windows\System\yiRtdVv.exe
  C:\Windows\System\yiRtdVv.exe
  2⤵
  PID:11412
- C:\Windows\System\MNAECtl.exe
  C:\Windows\System\MNAECtl.exe
  2⤵
  PID:11468
- C:\Windows\System\XNyICys.exe
  C:\Windows\System\XNyICys.exe
  2⤵
  PID:11592
- C:\Windows\System\ugOKCcl.exe
  C:\Windows\System\ugOKCcl.exe
  2⤵
  PID:11652
- C:\Windows\System\dnNSeDl.exe
  C:\Windows\System\dnNSeDl.exe
  2⤵
  PID:11720
- C:\Windows\System\MnDKHIu.exe
  C:\Windows\System\MnDKHIu.exe
  2⤵
  PID:11760
- C:\Windows\System\AhzhYAJ.exe
  C:\Windows\System\AhzhYAJ.exe
  2⤵
  PID:11884
- C:\Windows\System\UHdRrwm.exe
  C:\Windows\System\UHdRrwm.exe
  2⤵
  PID:11916
- C:\Windows\System\oTkFUPw.exe
  C:\Windows\System\oTkFUPw.exe
  2⤵
  PID:11936
- C:\Windows\System\nOyXjpH.exe
  C:\Windows\System\nOyXjpH.exe
  2⤵
  PID:12032
- C:\Windows\System\dNaHyRE.exe
  C:\Windows\System\dNaHyRE.exe
  2⤵
  PID:12096
- C:\Windows\System\PSgQeZI.exe
  C:\Windows\System\PSgQeZI.exe
  2⤵
  PID:12160
- C:\Windows\System\HbvqHmA.exe
  C:\Windows\System\HbvqHmA.exe
  2⤵
  PID:228
- C:\Windows\System\yYuduvO.exe
  C:\Windows\System\yYuduvO.exe
  2⤵
  PID:12216
- C:\Windows\System\krnSEjO.exe
  C:\Windows\System\krnSEjO.exe
  2⤵
  PID:11316
- C:\Windows\System\WHvwmEX.exe
  C:\Windows\System\WHvwmEX.exe
  2⤵
  PID:10640
- C:\Windows\System\xsigREx.exe
  C:\Windows\System\xsigREx.exe
  2⤵
  PID:11376
- C:\Windows\System\CKDhczv.exe
  C:\Windows\System\CKDhczv.exe
  2⤵
  PID:11500
- C:\Windows\System\xswhfTG.exe
  C:\Windows\System\xswhfTG.exe
  2⤵
  PID:11632
- C:\Windows\System\RWEOYVT.exe
  C:\Windows\System\RWEOYVT.exe
  2⤵
  PID:11696
- C:\Windows\System\MOsWZsU.exe
  C:\Windows\System\MOsWZsU.exe
  2⤵
  PID:11844
- C:\Windows\System\pPzrkAh.exe
  C:\Windows\System\pPzrkAh.exe
  2⤵
  PID:11980
- C:\Windows\System\wWBqDaw.exe
  C:\Windows\System\wWBqDaw.exe
  2⤵
  PID:12080
- C:\Windows\System\vXXlzUL.exe
  C:\Windows\System\vXXlzUL.exe
  2⤵
  PID:12356
- C:\Windows\System\PLmMZvk.exe
  C:\Windows\System\PLmMZvk.exe
  2⤵
  PID:12388
- C:\Windows\System\XHWTNbC.exe
  C:\Windows\System\XHWTNbC.exe
  2⤵
  PID:12408
- C:\Windows\System\fCdWlcT.exe
  C:\Windows\System\fCdWlcT.exe
  2⤵
  PID:12440
- C:\Windows\System\xmHCNqX.exe
  C:\Windows\System\xmHCNqX.exe
  2⤵
  PID:12460
- C:\Windows\System\xabQHqd.exe
  C:\Windows\System\xabQHqd.exe
  2⤵
  PID:12480
- C:\Windows\System\FeRPyHF.exe
  C:\Windows\System\FeRPyHF.exe
  2⤵
  PID:12544
- C:\Windows\System\TbHRcQi.exe
  C:\Windows\System\TbHRcQi.exe
  2⤵
  PID:12572
- C:\Windows\System\oBzAfaV.exe
  C:\Windows\System\oBzAfaV.exe
  2⤵
  PID:12596
- C:\Windows\System\GFJscut.exe
  C:\Windows\System\GFJscut.exe
  2⤵
  PID:12612
- C:\Windows\System\IqHJrft.exe
  C:\Windows\System\IqHJrft.exe
  2⤵
  PID:12644
- C:\Windows\System\sinKEVv.exe
  C:\Windows\System\sinKEVv.exe
  2⤵
  PID:12672
- C:\Windows\System\wSZTKxL.exe
  C:\Windows\System\wSZTKxL.exe
  2⤵
  PID:12696
- C:\Windows\System\DhqpNSw.exe
  C:\Windows\System\DhqpNSw.exe
  2⤵
  PID:12716
- C:\Windows\System\LBtDBUn.exe
  C:\Windows\System\LBtDBUn.exe
  2⤵
  PID:12768
- C:\Windows\System\vlOkBvI.exe
  C:\Windows\System\vlOkBvI.exe
  2⤵
  PID:12792
- C:\Windows\System\OXPyWur.exe
  C:\Windows\System\OXPyWur.exe
  2⤵
  PID:12828
- C:\Windows\System\CtrQhXj.exe
  C:\Windows\System\CtrQhXj.exe
  2⤵
  PID:12868
- C:\Windows\System\zMSRGur.exe
  C:\Windows\System\zMSRGur.exe
  2⤵
  PID:12888
- C:\Windows\System\puJqYkL.exe
  C:\Windows\System\puJqYkL.exe
  2⤵
  PID:12916
- C:\Windows\System\xwYMZEG.exe
  C:\Windows\System\xwYMZEG.exe
  2⤵
  PID:12944
- C:\Windows\System\kEycNSI.exe
  C:\Windows\System\kEycNSI.exe
  2⤵
  PID:12984
- C:\Windows\System\UUHQzhA.exe
  C:\Windows\System\UUHQzhA.exe
  2⤵
  PID:13004
- C:\Windows\System\dprpIvr.exe
  C:\Windows\System\dprpIvr.exe
  2⤵
  PID:13028
- C:\Windows\System\SWdHYeS.exe
  C:\Windows\System\SWdHYeS.exe
  2⤵
  PID:13048
- C:\Windows\System\mvvPPHF.exe
  C:\Windows\System\mvvPPHF.exe
  2⤵
  PID:13076
- C:\Windows\System\HxaUzTm.exe
  C:\Windows\System\HxaUzTm.exe
  2⤵
  PID:13104
- C:\Windows\System\KAgzvyB.exe
  C:\Windows\System\KAgzvyB.exe
  2⤵
  PID:13124
- C:\Windows\System\wgXXnnx.exe
  C:\Windows\System\wgXXnnx.exe
  2⤵
  PID:13176
- C:\Windows\System\TcIKQUz.exe
  C:\Windows\System\TcIKQUz.exe
  2⤵
  PID:13212
- C:\Windows\System\IBBNvBl.exe
  C:\Windows\System\IBBNvBl.exe
  2⤵
  PID:13232
- C:\Windows\System\wjXLfUj.exe
  C:\Windows\System\wjXLfUj.exe
  2⤵
  PID:13252
- C:\Windows\System\rAWxdcJ.exe
  C:\Windows\System\rAWxdcJ.exe
  2⤵
  PID:13268
- C:\Windows\System\UtbFQBS.exe
  C:\Windows\System\UtbFQBS.exe
  2⤵
  PID:13288
- C:\Windows\System\NTaGtCb.exe
  C:\Windows\System\NTaGtCb.exe
  2⤵
  PID:7028
- C:\Windows\System\DohpZOi.exe
  C:\Windows\System\DohpZOi.exe
  2⤵
  PID:12296
- C:\Windows\System\crvNwVW.exe
  C:\Windows\System\crvNwVW.exe
  2⤵
  PID:11296
- C:\Windows\System\fUtkLMV.exe
  C:\Windows\System\fUtkLMV.exe
  2⤵
  PID:11600
- C:\Windows\System\OCyovnz.exe
  C:\Windows\System\OCyovnz.exe
  2⤵
  PID:12404
- C:\Windows\System\kTSKdjC.exe
  C:\Windows\System\kTSKdjC.exe
  2⤵
  PID:12368
- C:\Windows\System\btBLLit.exe
  C:\Windows\System\btBLLit.exe
  2⤵
  PID:12456
- C:\Windows\System\sQzRQZt.exe
  C:\Windows\System\sQzRQZt.exe
  2⤵
  PID:12584
- C:\Windows\System\ddNlscW.exe
  C:\Windows\System\ddNlscW.exe
  2⤵
  PID:12608
- C:\Windows\System\hylWimL.exe
  C:\Windows\System\hylWimL.exe
  2⤵
  PID:12640
- C:\Windows\System\RdMVJVi.exe
  C:\Windows\System\RdMVJVi.exe
  2⤵
  PID:12724
- C:\Windows\System\zChMWOW.exe
  C:\Windows\System\zChMWOW.exe
  2⤵
  PID:12788
- C:\Windows\System\wtORdsC.exe
  C:\Windows\System\wtORdsC.exe
  2⤵
  PID:12900
- C:\Windows\System\kcNkllE.exe
  C:\Windows\System\kcNkllE.exe
  2⤵
  PID:12936
- C:\Windows\System\QpxOxAo.exe
  C:\Windows\System\QpxOxAo.exe
  2⤵
  PID:13000
- C:\Windows\System\EKzqTdc.exe
  C:\Windows\System\EKzqTdc.exe
  2⤵
  PID:13088
- C:\Windows\System\TkqIdCc.exe
  C:\Windows\System\TkqIdCc.exe
  2⤵
  PID:13160
- C:\Windows\System\KyqxDGg.exe
  C:\Windows\System\KyqxDGg.exe
  2⤵
  PID:13192
- C:\Windows\System\EQBLZMj.exe
  C:\Windows\System\EQBLZMj.exe
  2⤵
  PID:13264
- C:\Windows\System\edVlhNX.exe
  C:\Windows\System\edVlhNX.exe
  2⤵
  PID:1224
- C:\Windows\System\cTwSmob.exe
  C:\Windows\System\cTwSmob.exe
  2⤵
  PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fongfiae.opa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fongfiae.opa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BKTSbxC.exe

Path C:\Windows\System\BKTSbxC.exe
Size 1.9MB
SHA256 e82ffffcaa9355c465913b599c27b8ab35926b10cda46b47b333a0c530314309
MD5 d29e5a0784893eb6636e409ab0ad860f
SHA1 29bf6a88e4aa06e5a358d855dfee3398692377d6
SHA512 7891cd552e8a87d99d12ecbbcef195839d470c67a194127d7c4a4d353c2822d9cfa1a171c88cb299839d2e9c4f47f7e1fd5c15ef1b153ee7f919bebe8c0a6b3f
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UJ:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

BLjkpgj.exe

Path C:\Windows\System\BLjkpgj.exe
Size 1.9MB
SHA256 f976547ab7b75a73a4d5c1f3e812e588556c202b8d74e1ab7488e1d949783630
MD5 aac0f63850fbd4c4bdfd79f50595e177
SHA1 cae66043da7401dacc18afaadbc472129237c0b3
SHA512 b197e72af19b1019c54911e6548c39f55c7b6a8d3843f8c6223f53a5a5760e9654860805d51d697acd823726fb6ad60dd96f0ecd8b6d1cccadd3f0c50ff0a1c5
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U9:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

DdIBLuI.exe

Path C:\Windows\System\DdIBLuI.exe
Size 1.9MB
SHA256 527eea9a77a97de9e76a0a46e0e95a5c83a5e78f96b3404a478e0a542124edc6
MD5 cfa0d6db8fcf7a086e65ffb521e3e3d1
SHA1 edbc6e6354b36141bdf7612df4271f7cc4601301
SHA512 8e0635c60f5eded44d3a98cb49a5efd4ec84f5bc1378bebad277c9bf7ee16f3ced873528ead6007caafc7161ed6d4404d5915c69ca97514ab1a1cd7eedecd190
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UF:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DnwVNRw.exe

Path C:\Windows\System\DnwVNRw.exe
Size 8B
SHA256 7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1
MD5 a8f2921c80c15a3d426e5fdff8a56196
SHA1 4dc21bf95e22427a9dafcd4930e81b62e77d5fda
SHA512 996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802
MD5 SHA1 SHA512

Submit Download

FRLvPWF.exe

Path C:\Windows\System\FRLvPWF.exe
Size 1.9MB
SHA256 997b2ab5f64871a13a96273e7e9a8c7a2a541e2f27b0b6cb4adba7aa382ec842
MD5 d965a2c4b25e3ea27a0f1df5f395119e
SHA1 93fa0afc508bcda037c1db2e4ddb2ef560677aa0
SHA512 d6e9d34ace5006ebacd83828685a2edb63bb8e922c4093f5bec8bfd10e0ad2035a001ab278411afc91ca20a4c750b0c023958ba56d10036201bc6ad985a226cf
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UF:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

HlAZIBO.exe

Path C:\Windows\System\HlAZIBO.exe
Size 1.9MB
SHA256 96a84809d012b3eb1163c3cde95daf1d58f47290d2a32f8c4edbbc2ad521b3c9
MD5 05b0041e93836720dc2a08ff88fe2ab6
SHA1 3aee0b60a7a66d5f9130f4429292df5187c3ec8a
SHA512 702ec67fb4497573950bd6fd76db0afacf6ceb1f6b344553c823b974ad7948003c54d5a1e24b56adf5db482b386e57cb60011a93ae9708d32edc01bc03e3dc6e
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UQ:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

KKoAfPw.exe

Path C:\Windows\System\KKoAfPw.exe
Size 1.9MB
SHA256 2e447afee5f940124582733a61c8d9e954b6d716e3a024e8f444a2a7df4d6cc0
MD5 e3d9be6b548414b43b74a684ae67a31e
SHA1 69503457209fc4095bf8d3dcc3e169f61df22480
SHA512 d4058db41cfeb379a652bb1b88c5db31d1ddad1ea5af7ee0d0c260373615c683030c79b9cda773d9db329719566b2ccb2c9821e20699d42d6f912c6c450e297f
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U6:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHzWtGZ.exe

Path C:\Windows\System\PHzWtGZ.exe
Size 1.9MB
SHA256 2787ffab174f7c98566b18efc88806626c5743c24f14c39b70506f8a093424e6
MD5 35557b11ce9bcb4cb33896bdc551a951
SHA1 79bad4b0c6df24df532c845507edad704720ce9b
SHA512 5702257a42598ea5b45ba4049def24cdf54efb60f489ccecf9dc962091ae92f9ec94ecb3ec0e9352e045156bfecd92a8bc68f68d23e8834ebb68a19840ddbd43
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UH:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

QvBHgcJ.exe

Path C:\Windows\System\QvBHgcJ.exe
Size 1.9MB
SHA256 75ee4dcd82510da6f7db30c92da06377077f029bca9231db48e5e336147e051a
MD5 fb1c8ef4ad4533885eff71f2bc4a4a06
SHA1 58128d4179ade3ddba3f8304ac4738ac5d372884
SHA512 003a0d38b363d48167662a355372a9651c07a3b9cc41011f60b5aef15a66225d8c997974c968c42a2fa95ef12c46d5c7f034e2540c415ff5590b184624382819
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UK:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tiexlvh.exe

Path C:\Windows\System\Tiexlvh.exe
Size 1.9MB
SHA256 6c78d8892f47f620c839a8e103db81e18618bf397825b7932f08ba3743c5f6e9
MD5 3d64804946b22952e8bfa4a87e9fe769
SHA1 e558ff0ae5038ce84c1aaf31c12d403398e13765
SHA512 4872d55973aaa0dc8c627cc3200051a04aec936d9c8891f1eda92a41e82c941a26266dff0c83a0cc07005506ac2e98d97a930ffc6bf2790a9a76698b582b0a4c
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+US:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtGyPQj.exe

Path C:\Windows\System\UtGyPQj.exe
Size 1.9MB
SHA256 54fee36b5a24c0de60511c1be00fae018387d339eb0402387869e0cc0aaa84f9
MD5 43874d5fa637feadba6505adfd01ab6b
SHA1 75ded76205d1115cc1f5cde3b2bf2bd6ca78a031
SHA512 4c9dc592cd8bfeff9b64d80c3109de728e1506f0d97101dc77b1b0e2d85ba335d08ebf1e029026a5d9dec7655eb69158199369dc7556b0c0909b9ef9d4a943b1
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UP:NABg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCFKiPH.exe

Path C:\Windows\System\VCFKiPH.exe
Size 1.9MB
SHA256 9c1d3a2513ca43697851880e517d28e20d73fa3a2d7c8f326752c9463f2e267d
MD5 097272d6ba5368d2a40f9e0c6f67277c
SHA1 e6eff8c8bb5201ddfbdb5370161fee2d794820ee
SHA512 51236b628fa35b83aea6463807946060593d0b4ffd83ead42b4f10c1ba3eb844cc7f282ff8f6d65eef1540631da9c21e93ce644c693c12400203601198ff8730
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UZ:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VdTLFnl.exe

Path C:\Windows\System\VdTLFnl.exe
Size 1.9MB
SHA256 3e85286a821e0165875f4d71e67b2b89705ecc97ae3289cba0b2e5942b19551d
MD5 7f4f39abe6ecd5c65e39fa42dcd2e527
SHA1 9f21cc0c1f17f0d9a329d3f5dd1e9778fb1a8151
SHA512 669f9990c45bca700d1701e9e7a55028e74280bb61497f5384e8c4377f471a0159fd5726779e94f517654ba515fb072279b85854124c12691441ae7750141500
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UN:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdmYsCJ.exe

Path C:\Windows\System\WdmYsCJ.exe
Size 1.9MB
SHA256 5f57bbfd71aa62aed2c0ff33d8f0c030f15b603452def5e25dc5e4273f690663
MD5 fb68ebde605ae299b441261f4c2e28d9
SHA1 0c786f724f58c6951bd2359467f4065e0eedadb4
SHA512 a0cf899618ea69179a57fde0d02d69e073838613aa54e56b5464dde1439c903b858f21934897e11662ff749f212867594f542a29062bef28457e55124951b1ae
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U9:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

WuwiegC.exe

Path C:\Windows\System\WuwiegC.exe
Size 1.9MB
SHA256 cc49810c57a4e4956f7aec753d2c4d9d7ad212509e712821085f6bcb5f1e8960
MD5 5a8fa59a9ea9267bb0e6002b76d0d2d3
SHA1 597fafe965f32bb3f07ade1507e1c7dc1c207977
SHA512 fc3dbab68118aae43d325ff174b42e2ee6a64136571c746dfac175388f202d5de7cfd79bdc3f5a03b4a9f585a83b778d4217b1bed81eff317fdf9896384954a8
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UU:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

XnhbrWW.exe

Path C:\Windows\System\XnhbrWW.exe
Size 1.9MB
SHA256 abca0c2be4990434fdc56624c91e928ec5524f2423fd11a087738a38e8005671
MD5 6d198b4c999d6aa55dd441ed1d43707c
SHA1 cfe55f6a9f9e1b5fe8d535bd662b6981724f627e
SHA512 d9f0fc9ac2786c27454d3943e99f0794c5256c9a907f3c6478354f4b7801dce95b70f34a08e139a433048fdb1b15b1594c197f61da744530ab1633fda8322fab
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ux:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

YyNOLXU.exe

Path C:\Windows\System\YyNOLXU.exe
Size 1.9MB
SHA256 907cb0e31aba574a46500b0582cdc36c04b9fcc0dc9b2a0497be2c8f29165fd4
MD5 97da3dd3f4978db928a4981a9890bf7e
SHA1 733bdf003d10876b8bede264b0e18289381c8039
SHA512 1c23f299804aa73ba48f6c0ffbc2faaea5f515990da86213ae3cd534c35ae8238da04688f3ef136923ddaa64d0c0c5dfb0a83ca496a7dfc8d95c9718b15a1364
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uy:NABN
MD5 SHA1 SHA512 SSDEEP

Submit Download

aXVduOR.exe

Path C:\Windows\System\aXVduOR.exe
Size 1.9MB
SHA256 33d5650ff962c8584b05a0ef984d25c7d5e534465254f3d1eab9ebf342fc8c59
MD5 09788cd8e8088877e1cb00b0adfa6ba1
SHA1 42a00107fe3e2f0b86043f3cdfa680888b6d0069
SHA512 a78107c5995006e5bc9cf52b2af1b0dc9633cb9787a8f02d69703a84d72ead3c95232acd50f208888a06be64d591928eff53ca9e6a04d33c9eaa955352ab0a2e
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UR:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajazpdD.exe

Path C:\Windows\System\ajazpdD.exe
Size 1.9MB
SHA256 54385c1c1d07e781f00c85bc489c62454074392e6b49cc4c77bd08120523a537
MD5 30c24a2b7536a5e9ae774898ab2fcfc1
SHA1 291315beb25c1023ef439b4e895d1d4804b9d940
SHA512 8ead7e57f0fd2a2b453a7b3d329314f965d7c863a5fa8fba982e97e0d10ae7a2d5de877d3fc8247d398fac7665d050413147b1919f3e652f6c9579d0b0235659
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ud:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

anMJFkE.exe

Path C:\Windows\System\anMJFkE.exe
Size 1.9MB
SHA256 5af398a9a0e561e68297ee364d80fb600bc2c67a86deee9ac1cf80ab8a584802
MD5 9d019879d254df02cdac8f940b954033
SHA1 b13b1141de94ef33ed859e4c3909ea71704770ee
SHA512 39a70a38e455119d5a3cebe4ee32dd71ff181aeed550aeba2077237782e6fe6eaf40e0e19914e9061f6709eeac10b8a5f992fd9114faf711c6de31e1337914dd
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Up:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

fulODJi.exe

Path C:\Windows\System\fulODJi.exe
Size 1.9MB
SHA256 4aeb05826c6728b0b60b9e2806f0767a2af211285cc1453ca5f01dd37c050fe8
MD5 5c2adc5f08fea5929d974f263dcac9ad
SHA1 8882dc8522e014efe26594c605d14d4b8fd6dfd2
SHA512 76add0ad9ce24e11c1576293c4a647cc2f99875fc2f936959089fc78aa3297c0ff826827a5ed9772bb0baa4b89bc74c7d31f759fd17a1c821337dca66a026c8f
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ud/:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

iLtWcAs.exe

Path C:\Windows\System\iLtWcAs.exe
Size 1.9MB
SHA256 7ed66e696f643d15d13355bc5e0e8c7c130b37eda2f145ee64544705661ba5e2
MD5 0a2fd21c61b1c197275644fe6441f04e
SHA1 0d862ebd9901724c7c7e327de47e346f41ab0720
SHA512 b20e0d2f64e9354e92ff861f2a21ae8480fb8af43974c5cf7643e72f017b8b097e5eb6d233a8285bced944a7497ada96a4a16973d384d11226f2ffa837a4f3bd
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UT:NAB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ielurPd.exe

Path C:\Windows\System\ielurPd.exe
Size 1.9MB
SHA256 efb2d0fb302e211c6151b080148be3e131fea42803a3629caae59d28ace005ea
MD5 a508a66a66b676b1890e62f3eaf0c160
SHA1 7824a86093e176b5f7037dacb08ca7bf642bd99c
SHA512 476cd2891036e3a6db26d28f780809dbd5828dd1309d933e5cc2d19902672481e5e4aa8f99d4f3f950be32394491fc6170e44c15835b953438a41dd3e56c27a9
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uo:NABN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixKnPdR.exe

Path C:\Windows\System\ixKnPdR.exe
Size 1.9MB
SHA256 59b54862448f7c5a65758be78d2f7696391a0cfe426890ec233fe46aef705996
MD5 d729406a3313d9d6cb3568d84ced46f0
SHA1 041e941ef74998ef1dc86c2dda1e801f69519521
SHA512 00fe89d15129d67b4ad2bc600867182acc3c9efb471932b540cf49de8195b05d6742a2e73f0326933e4538982c900e2389e17b75d9ad98a218a31a07dd06fda7
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UZ:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

iyrGRee.exe

Path C:\Windows\System\iyrGRee.exe
Size 1.9MB
SHA256 76f92e2f70d5cf564bbf79c0e084dd045cd5cc9f80f6a0ff0153da5c795465c3
MD5 36ac7729dd47543ddbcf92181ea4f2e2
SHA1 4904075207d62c41fb90cae5eb1dc1031c5d1634
SHA512 71bd5761caed9fee25968cc4b8964fefcd37d80e8bdb892e191847ab13114da49531617b7e4c7f26d533bc355b7f6210a89bd871dfb0ebfa8858f5034320d33f
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ut:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jEJXgNg.exe

Path C:\Windows\System\jEJXgNg.exe
Size 1.9MB
SHA256 09e4cd3b61847f562e84befa3652f8d7f794f5ca141d3b7b73fc70ccb3215fab
MD5 f5381282e6fb390b46a194ef1171562a
SHA1 9fd420d3891296b08df688ec70528fb8c2f5be77
SHA512 987f00f28bc66c342e2afbe58d2b2524176493234f7310d8a3abde8909077c564ad10d94ba7b38bc0ab8114d9e6d4557a610a009a8b9735bbff363c8c06821ac
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UD:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lSReJmJ.exe

Path C:\Windows\System\lSReJmJ.exe
Size 1.9MB
SHA256 4ecefe42db4d19827b82f008eeae7e35b68f3f53d9bb80a9ca92e923d4c563af
MD5 27668f36851089411208a74c99a49c56
SHA1 55cb46c9056cf03b23b2a1f2e4f4ba8461f8b800
SHA512 155a7ad9751658975d0420b8268bb9acb07a671ce2b0d75aef74991626f6118fc8cc0b067115e84c4a21bc09e2e76f9aa5866986ec87ace4dcfa146a7be0ea95
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U8:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

nLQXojG.exe

Path C:\Windows\System\nLQXojG.exe
Size 1.9MB
SHA256 ca8a25688707914392f94c5f12385abfe703782c3cfc519e69a2c21e899f5db5
MD5 282bcd521fd97404217097f747b367f1
SHA1 f3e4935ca9bd2322fb42849c60e7d5b0c24d870e
SHA512 67571dc52fd94551507aa447244fdca57cb73741737390ad60b0d2f0ca5cc9d31cfbb678af50d88068a0c01ea5e260e6bc48080bacd45d0740df67aadb5c9b5b
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uq:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

nliYJCC.exe

Path C:\Windows\System\nliYJCC.exe
Size 1.9MB
SHA256 905e707937955a55037802a88b0b197bba897a040ee4eb1dc4f09694064821e8
MD5 e889295a997396842fca305eda1fdfcb
SHA1 5d19aec431e9e88d9315af1ad6831ec5d6b8928d
SHA512 4f4579c6d306fef81d36be113f5573fe866d81997a53e5e9f3c66513615f8dee95d3b8eff76709fcf6d90809b17f853538bf64fb94b0fe3a4bb15a8e9854731a
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U3:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

nmbPpuW.exe

Path C:\Windows\System\nmbPpuW.exe
Size 1.9MB
SHA256 dfeab0bba94b71baa75de33283158f1488141f92fb508d93787c1867b324530e
MD5 8ad42b9c0da2a3680666fe9028d903cc
SHA1 f225ca6fef0cfd08ad1bc807db4e44e492370732
SHA512 d171ba388ec90e21f356fc42d8731e9f7e8850709114bba610288ca3a7839cb9cdf179601f688f698cdbdc8ca872e7892532204726ae91976c2b46b2e67acd07
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UL:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

onevXfS.exe

Path C:\Windows\System\onevXfS.exe
Size 1.9MB
SHA256 fa247b79ec8ff98ea36fb19c7364a28df50a4ac55b519412370b2202223c6b5b
MD5 ce3a3ea0eb6c31ae597021bcd3c293d4
SHA1 5505069cac88fc73bf4f80b6ba7404c5fbb932cb
SHA512 55b4cb8feee49b92f072277319642e2824a5e73cb2046779cf0e66c9337e7a98482cc2faa6c55c79e94180a5b356f0588499b802eca154441dc32f0af233d834
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ug:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

sFnbeRF.exe

Path C:\Windows\System\sFnbeRF.exe
Size 1.9MB
SHA256 338457b787a0c9dd3e9191da28f5ebb047b848be557f222d2144b3439aa7d060
MD5 827bad914c0bba4ed155ffd0a43ed215
SHA1 f1871eea5eef12e069f66a588f62a3bd65e149a6
SHA512 942eb1b88c1dc1313cb39b154705533f9a492da0c70649466fa505c53dcbd94d2ededa05379a8d0de01e7de59330f8cf92c34041f76faf2d6fd3e4bf6462d708
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UO:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsGDcbN.exe

Path C:\Windows\System\wsGDcbN.exe
Size 1.9MB
SHA256 fcb2387fb41ede98fece807ff6898e9f439466eca9883ab8e318b7f5593c5558
MD5 44e1f7810c2ddf7eaae7612c75a4cd21
SHA1 291761533e2e94a650f164b3f7e74f2583051b5f
SHA512 5b29be357d64109ab5095dd51377bddea36926581160060ea2bb6e3234f15fcc725f232a2c718e6a57fe8b70283a457da6b2942e6028afcc4d29b49ca172fc50
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UO:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

xSubBrr.exe

Path C:\Windows\System\xSubBrr.exe
Size 1.9MB
SHA256 05e41216196e595028ab0d49cd850883661eedbf3b90f62e6a60cb80911342da
MD5 b0a6063df5dcb15339e55f0b4818357b
SHA1 ecf26bd3cdac1d6adffed5f9b0b5596c7eb43a8a
SHA512 0f2bc9e54a308487e35681cd9bdba83db6f780c5a6c78dbf91eeca4816a54b4a1b5bebbb9aad1b8a40c0854852da9ce2bb7f2a54bdc29c16130469b2f62345ae
SSDEEP 49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UY:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-475-0x00007FF646390000-0x00007FF646782000-memory.dmp

Download

memory/368-2452-0x00007FF646390000-0x00007FF646782000-memory.dmp

Download

memory/564-0-0x00007FF600B70000-0x00007FF600F62000-memory.dmp

Download

memory/564-1-0x0000022ED9460000-0x0000022ED9470000-memory.dmp

Download

memory/1220-524-0x00007FF762320000-0x00007FF762712000-memory.dmp

Download

memory/1220-2460-0x00007FF762320000-0x00007FF762712000-memory.dmp

Download

memory/1268-2448-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp

Download

memory/1268-474-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp

Download

memory/1404-54-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp

Download

memory/1404-2428-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp

Download

memory/1576-495-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp

Download

memory/1576-2472-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp

Download

memory/1596-70-0x000002B579480000-0x000002B5794A2000-memory.dmp

Download

memory/1596-50-0x000002B5794E0000-0x000002B5794F0000-memory.dmp

Download

memory/1596-48-0x00007FFF98A50000-0x00007FFF99511000-memory.dmp

Download

memory/1596-1863-0x00007FFF98A50000-0x00007FFF99511000-memory.dmp

Download

memory/1676-2434-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp

Download

memory/1676-469-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp

Download

memory/2268-2465-0x00007FF708090000-0x00007FF708482000-memory.dmp

Download

memory/2268-506-0x00007FF708090000-0x00007FF708482000-memory.dmp

Download

memory/2972-2450-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp

Download

memory/2972-539-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp

Download

memory/3068-2439-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp

Download

memory/3068-473-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp

Download

memory/3128-2446-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp

Download

memory/3128-470-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp

Download

memory/3328-2454-0x00007FF7994A0000-0x00007FF799892000-memory.dmp

Download

memory/3328-476-0x00007FF7994A0000-0x00007FF799892000-memory.dmp

Download

memory/3424-488-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp

Download

memory/3424-2473-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp

Download

memory/3512-529-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp

Download

memory/3512-2432-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp

Download

memory/3560-472-0x00007FF701C30000-0x00007FF702022000-memory.dmp

Download

memory/3560-2444-0x00007FF701C30000-0x00007FF702022000-memory.dmp

Download

memory/3564-2462-0x00007FF723D50000-0x00007FF724142000-memory.dmp

Download

memory/3564-521-0x00007FF723D50000-0x00007FF724142000-memory.dmp

Download

memory/3664-2436-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp

Download

memory/3664-67-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp

Download

memory/3896-471-0x00007FF663320000-0x00007FF663712000-memory.dmp

Download

memory/3896-2443-0x00007FF663320000-0x00007FF663712000-memory.dmp

Download

memory/4048-2441-0x00007FF773A30000-0x00007FF773E22000-memory.dmp

Download

memory/4048-533-0x00007FF773A30000-0x00007FF773E22000-memory.dmp

Download

memory/4300-477-0x00007FF761C70000-0x00007FF762062000-memory.dmp

Download

memory/4300-2470-0x00007FF761C70000-0x00007FF762062000-memory.dmp

Download

memory/4516-478-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp

Download

memory/4516-2469-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp

Download

memory/4964-2419-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp

Download

memory/4964-2430-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp

Download

memory/4964-14-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp

Download